home

esetoffupdate-x32,x64-23.02.2013-anagradsoft.rar.exe

Moshe Caspi

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application esetoffupdate-x32,x64-23.02.2013-anagradsoft.rar.exe, “Installer for SoftSafe” by Moshe Caspi has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
SoftSafe  (signed by Moshe Caspi)

Product:
SoftSafe

Description:
Installer for SoftSafe

Version:
2013.2.28.1540

MD5:
b165f93887fee9cbbf866ac25698b31c

SHA-1:
54641300ba7ea6285b4aa4d6b6b0ec8c9b2d8612

SHA-256:
7c5efcddaa3636fe283ae0e787990a3282f67701c6da0b2a88a1f9673927a49f

Scanner detections:
32 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/26/2024 7:01:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Generic.564033
887

Agnitum Outpost
PUA.InstalleRex
7.1.1

AhnLab V3 Security
Adware/Win32.StartPage
2014.09.01

Avira AntiVirus
ADWARE/InstallRex.Gen
7.11.170.52

avast!
Win32:Downloader-UZF [PUP]
140813-1

AVG
Adware AdInstaller.P
2014.0.4015

Bitdefender
Adware.Generic.564033
1.0.20.1220

Bkav FE
W32.FamVT.AntiFWK.Trojan
1.3.0.4959

Clam AntiVirus
Win.Adware.563206
0.98/19317

Comodo Security
Application.Win32.Agent.V
19383

Dr.Web
Adware.Downware.893, Adware.Downware.1004
9.0.1.05190

Emsisoft Anti-Malware
Adware.Generic.564033
9.0.0.4324

ESET NOD32
Win32/InstalleRex.E potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/InstalleRex
9/1/2014

F-Prot
W32/InstallRex.B
4.6.5.141

F-Secure
Adware.Generic.564033
11.2014-01-09_2

G Data
Adware.Generic.564033
14.9.24

IKARUS anti.virus
PUA.InstallRex
t3scan.1.7.5.0

K7 AntiVirus
Unwanted-Program
13.183.13218

Kaspersky
not-a-virus:HEUR:Downloader.Win32.AdLoad
15.0.0.463

Malwarebytes
PUP.Optional.InstallRex
v2014.09.01.01

MicroWorld eScan
Adware.Generic.564033
15.0.0.732

NANO AntiVirus
Riskware.Win32.Downware.ctkpid
0.28.2.61861

nProtect
Trojan/W32.StartPage.307744
14.08.31.01

Panda Antivirus
PUP/TSUploader
14.09.01.01

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Quick Heal
Backdoor.Clack.ard
9.14.14.00

Reason Heuristics
Adware.WebPick.Installer.n
14.9.1.0

Sophos
InstallRex
4.98

Vba32 AntiVirus
Downware.TSU
3.12.26.3

VIPRE Antivirus
Threat.4753027
32210

Zillya! Antivirus
Trojan.Badur.Win32.454
2.0.0.1907

File size:
300.5 KB (307,744 bytes)

Product version:
1.0

Copyright:
Copyright © 2012 SoftSafe

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Common path:
C:\users\{user}\downloads\esetoffupdate-x32,x64-23.02.2013-anagradsoft.rar.exe

Digital Signature
Signed by:
Moshe Caspi

Authority:
COMODO CA Limited

Valid from:
8/2/2012 3:00:00 AM

Valid to:
8/3/2013 2:59:59 AM

Subject:
CN=Moshe Caspi, O=Moshe Caspi, STREET=Hashuk 39, L=Tel Aviv, S=Israel, PostalCode=66067, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B1B859272556EC39AF8F0E4A626C2ADC

File PE Metadata
Compilation timestamp:
2/4/2013 11:49:08 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:1r+GI5RxWBDg7V0eXze6OvA48FjEeYQQGkK+PtAD+jJpZgzehJEjA/CP/7O:1rvI3sBDJejgPIjQNK+Fs+BsjA/uy

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.