file_installer.exe

Apps Installer S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application file_installer.exe by Apps Installer S.L has been detected as adware by 57 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.downloadiechahrixiew.com. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.
Remove file_installer.exe - Powered by Reason Core Security
Publisher:
App.install  (signed by Apps Installer S.L.)

Description:
setup.manager

Version:
3.1.12.5

MD5:
d5103e38c18adec117daa65f69490c3b

SHA-1:
977f45392c4bf7d73a8a994258f5a5bb37230707

SHA-256:
2a8fc50cd5d867d15553ef4f7ab80c96813adbcf53f8ae55bb85ad07d43d2a0c

Scanner detections:
57 / 68

Status:
Adware

Explanation:
This is a wrapped installation of legitimate software (without persmission of the developer) and bundles adware such as toolbars and extensions.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/7/2016 7:39:22 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.M
969

Avira AntiVirus
APPL/FirseriaI.A
7.11.153.178

avast!
Win32:Solimba-C [PUP]
2014.9-140610

Bitdefender
Application.Bundler.M
1.0.20.805

Comodo Security
Application.Win32.Firseria.K
18458

Dr.Web
Trojan.MulDrop5.32888
9.0.1.0161

ESET NOD32
Win32/FirseriaInstaller (variant)
8.9907

F-Secure
Application.Bundler.M
11.2014-10-06_3

G Data
Application.Bundler
14.6.24

K7 AntiVirus
Unwanted-Program
13.1712333

K7 Gateway Antivirus
Unwanted-Program
13.1712333

Kingsoft AntiVirus
Win32.Troj.Generic.a.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.AppsInstaller
v2014.06.10.04

McAfee
Artemis!D5103E38C18A
5600.7103

McAfee Web Gateway
Artemis!D5103E38C18A
7.7103

MicroWorld eScan
Application.Bundler.M
15.0.0.483

Reason Heuristics
PUP.Installer.AppsInstallerSL.O
14.8.7.18

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.26.0

VIPRE Antivirus
DownloadMR
30028

Remove file_installer.exe - Powered by Reason Core Security
File size:
496.4 KB (508,264 bytes)

Product version:
3.1.15

Copyright:
copyright © 2014

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\file_installer.exe

Digital Signature
Authority:
Thawte, Inc.

Valid from:
2/19/2013 1:00:00 AM

Valid to:
2/20/2015 12:59:59 AM

Subject:
CN=Apps Installer S.L., O=Apps Installer S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
323F44D66AEF890F43C32CFD743A4AD0

File PE Metadata
Compilation timestamp:
6/3/2014 12:18:13 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:9YYZr6ypt7xGspjYu+Uhx63UXBQddduJDOxe9:9Ycr6y/xxsg9BND0e9

Entry address:
0xE05C

Entry point:
E8, 7A, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 38, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, F8, E0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Entropy:
7.6467

Code size:
113.5 KB (116,224 bytes)

The file file_installer.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/19204377/launch

Remove file_installer.exe - Powered by Reason Core Security