home

freewifihotspot.exe

Web Software

Beijing Qingchuanglianxiang Technology Co Ltd

The application freewifihotspot.exe, “Web Software Setup ” by Beijing Qingchuanglianxiang Technology Co has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.centerbytebest.com and multiple other hosts.
Publisher:
Prog Lite Installer   (signed by Beijing Qingchuanglianxiang Technology Co Ltd)

Product:
Web Software

Description:
Web Software Setup

MD5:
3a3390c383f8f48877a6f56babc2f01b

SHA-1:
45fcab83129d8c97b088948525202caf83fb3095

SHA-256:
b9c78770de6495f7a38667b7a96a5680dfee5055d13b0bde46952ffccf0df173

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/11/2024 12:59:37 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ADX.gen potentially unwanted application
7.0.302.0

Reason Heuristics
PUP.InstallCore.Bundler (M)
16.1.27.20

File size:
904 KB (925,696 bytes)

Product version:
5.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freewifihotspot.exe

Digital Signature
Signed by:
Beijing Qingchuanglianxiang Technology Co Ltd

Authority:
COMODO CA Limited

Valid from:
9/11/2015 5:30:00 AM

Valid to:
9/11/2016 5:29:59 AM

Subject:
CN=Beijing Qingchuanglianxiang Technology Co Ltd, O=Beijing Qingchuanglianxiang Technology Co Ltd, STREET="1901,Moma Building, No.199 Chaoyangbei Road,", L=Chaoyang, S=BeiJing, PostalCode=100027, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E5F50EB929935434546FDDE8F49FCB1E

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:mtjvaxVYPchE3nUeRAJv5H7puxtqvVQXldh8:mlMVtAUeaJvxkbs8ldh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9366

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file freewifihotspot.exe has been seen being distributed by the following 11 URLs.

http://www.centerbytebest.com/c?x=hURczGeWa0ByOQ9L wy7LHIITpQfMApadds1azWWA8c=&c=fXT/tBeVNUvrFxZQT0KG UlQj/AOP1bnZJ4Gc0C5p7w8993wnbfeqFceNomm28WDoeMbQK59iCMUZT0aZs5FVRXwlh9hgbkTIui4xFoifeUAphUY/itkldAWZx026YT/s xjwEkKHv8BmI3hwn7o6QlXRlNCIyaklYtHDMvwxLU=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.free-wifi-hotspot.com/FreeWiFiHotspot.exe

http://www.cyclecleanapp.com/c?x=5GJTtygTwMEctBQ2PkvcXd2RtcMzLu0iaYqiuqQooms=&c=ySoX7Fo73jWvPart9JppFJwW6JickKS2Nal9tbTbXbpBn99wJwd7eYdaBtOpTHLbGQcHaL5z5VMWAmTzOR2Fa4rUcWfeNjL3OklFiCJjV5A/TRYx4TCCTDGlqrCeaKJQ8 pXiB0TMFsqj3A62S7HdinpdjptIQbp3vD7RxKPqso=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe;

http://www.cyclecleanapp.com/c?x=UPKGyNuLSSaOJs6saulA26Y905p0yVNLGN ocn3cgno=&c=KzOgL5ZxFhxceq4AbEMy6jXK7k1eBdAQo3ATy1EBE3q25oR6uERMRmnL c1Hg0843h8JpoUDSTWCWy8Wc/ppuz7korbkf7fRIgTGIy8ZPV9Y sF11BobPWGe3xKdlS9kDuAcEQYYCQ9dQxuBPK/DQSN6Vrn8eVKQEPLLBZQZnd8=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe;

http://www.flashcontentgift.com/c?x=03UClp67Vl3Ub395BIEzeeU2jjrI2gDm/Lz 7676SFM=&c=PqNkwZdCiUR dn45j6r0hQTSS1M6VgJq4uQwZR1B2Cby2gyJN3 zMhdPW8sH89FVfdt53bXrdGQSOxGBoO1qXkoGRYeO5qWPMnHtbSQHq8toAYrSYadLRiagHbuyN/vc9VDeiA oNrx2HRu3EZ9z0u0Q4Wxl0rV8h0XUQhTC dA=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.applicationsmetalaboratory.com/c?x=5eQjfQBvv3fblin/0quWxuROrYEDnSz6YJ/84BXjknM=&c=vr4bOHn13DHYQmawNFILpe9r6ZsTflABZayUspOSPHK38yxrrreZvAmtbEmHaW6eRE9EwzH 5z5jni0 Bo1wydphZ6DTJ 45SrDnCEuWFdZEN2b/b/58eSDu YRJUakCjtynYQZ/uSR4vrBxDGxsH5bDmduPJE5XG5j5qx5uOvk=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.senddeliverysigns.com/c?x=ApL1xOe1oUK 4eZ5yQNUjtp8RmifLyUorAremR4DWnw=&c=x0Ip1ebORNiEsg7tqFsWxq TA0yIqN2gdvIOa6 Uh2ko5HTGerwm Y9NPrLLNGqzkpEpaYqUI79CIzVbSTXkhPsBW3Y/CXADXokHOL BugMKSOwW7caFzupkFTfNwB1oSbF/mhnaZe/ yIz2ECb MrZfkOxF6OcK3fqH6DebpVQ=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe;

http://www.farmrepositoryfactory.com/c?x=ijL RHjA4FNi8GciOikwn2B4lVLiwteDKP98nBTSYxk=&c=xWkj9mVo OFWdOfIupjP2Kah3HLSx/nuGNSmzjKpAAeXivjieTKuB9QMOKmYzGhrtcKr2WQjTU8gF3F3h5nMY lIgtm8TsJp92yGPlKKD6Otce1Yl5kDRLuAExd/ztxoH/nAurzlTdaLOVcf7DbQXwIBFqxBFzp4zkVMAIQopOQ=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.bestsignsfile.com/c?x=ajWusQ5KF1i1Ee12EXMuT2PNViljVnWhcVEPOK59fKk=&c=/6NQJqkhWnNqBcRG2Vjr3ewMz9hVKNEANrDEeqMCSYIAnaCIn15ia6dlxgwzuMZuV2j1 oXqHFXK9FBpppxlZMZ0FMg82xAWlVnwW5dm1YRROozjxeeQb5K7I sULqcd ZsYAHM9B 9lV0sISZGwCNUVAiZ3Bfe2pK9FTZDIUk=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.applicationsbundlecycle.com/c?x=yX41Soo/zQDgIFj1sFwIf NM3St6JknjJPZiqAvnBqg=&c=KXr mVda12vKZ2t1UzueFT8fKXpjWRYCcweQJBwJEnzThav3HzXt6JcKQPO3p4b1xwQJsNvs5e2A2bJu7E/jNcG avVbngPOXxwOYEqXQUjX47J8cCZnGVUym2lRAE/FaXjctfsp6sm1GV5I6qxUWYhn84fQ28a6n3CfxJ6a7a8=&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

http://www.worldcyclemeta.com/c?x=n4WxnKuRfteMscIAD89bQ044h3L0yOOF3F2erDRsIxY=&c=G2KlnZfvhqUgl6DpjCY6Kix/EbOewnNAOkudaFUJ e33RydTr IVOVgMlbABhGKlgUhDIkQ0nfTjiUFepuLjWCpUrwpUCwv6HrMksGHdevaqGsoaNsNaB2 xi93PbCYiX4nDPqWhTvLeAQ66 zHXZw==&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe

Remove freewifihotspot.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.