home

form hacking.exe.exe

Eilio Developments sl

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application form hacking.exe.exe by Eilio Developments sl has been detected as adware by 94 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.
Publisher:
Eilio Developments sl  (signed and verified)

MD5:
d3627f92d254a1cd04b0743f0f055e6f

SHA-1:
3e430a023863702d588938a1a5711e410a54f34c

SHA-256:
8d6cc037914c764408732896a0bdc49ba443ac63cf7477b6a28945d1d61f5711

Scanner detections:
68 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/24/2024 5:06:18 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Mplug.FU
5650986

Agnitum Outpost
PUA.Solimba
7.1.1

AhnLab V3 Security
PUP/Win32.Morstar
2015.02.12

Avira AntiVirus
APPL/Solimba.Gen4
7.11.208.148

avast!
Win32:Solimba-M [PUP]
2014.9-150421

AVG
Generic
2016.0.3133

Baidu Antivirus
Adware.MSIL.Solimba
4.0.3.15421

Bitdefender
Adware.Mplug.FU
1.0.20.555

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Mplug-2063
0.98/20056

Dr.Web
Adware.Downware.9692
9.0.1.0111

Emsisoft Anti-Malware
Adware.Mplug.FU
8.15.04.21.03

ESET NOD32
MSIL/Solimba.AL potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/Morstar
4/21/2015

F-Prot
W32/S-2254ab4b
v6.4.7.1.166

F-Secure
Adware.Mplug.FU
5.13.68

G Data
Adware.Mplug.FU
15.4.25

herdProtect (fuzzy)
variant of ps3%20media%20server.exe (Adware)
2015.7.22.11

IKARUS anti.virus
PUA.MSIL.Solimba
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.193.14895

Kaspersky
not-a-virus:Downloader.Win32.Morstar
14.0.0.2159

Malwarebytes
PUP.Optional.Solimba
v2015.04.21.03

MicroWorld eScan
Adware.Mplug.FU
16.0.0.333

NANO AntiVirus
Riskware.Win32.Downware.dnpahc
0.30.0.65070

nProtect
Trojan.GenericKD.2149893
15.02.11.01

Panda Antivirus
Trj/Genetic.gen
15.04.21.03

Reason Heuristics
Threat.Solimba.EilioDevelopmentssl
15.4.20.23

Rising Antivirus
PE:Malware.Morstar!6.19F8
23.00.65.15419

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.26.3

VIPRE Antivirus
Threat.4782980
37240

Zillya! Antivirus
Backdoor.PePatch.Win32.64336
2.0.0.2068

File size:
517.1 KB (529,480 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\form hacking.exe.exe

Digital Signature
Signed by:
Eilio Developments sl

Authority:
GlobalSign nv-sa

Valid from:
7/28/2014 7:17:10 AM

Valid to:
7/28/2016 7:17:10 AM

Subject:
CN=Eilio Developments sl, O=Eilio Developments sl, L=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11218832573D4BDD488A310AF2AC15B41F25

File PE Metadata
Compilation timestamp:
2/6/2015 7:19:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:zgHBheOBXjVUpMQSKTgohsAt23tbkzFUu:z+UWVUpMQSegA23tbkT

Entry address:
0xB92C

Entry point:
E8, 57, 4D, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, E0, 09, 42, 00, E8, 3E, 15, 00, 00, E8, 28, 4F, 00, 00, 0F, B7, F0, 6A, 02, E8, EA, 4C, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 85, 42, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.7186  (probably packed)

Code size:
96 KB (98,304 bytes)

Remove form hacking.exe.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.