» greed- black border.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

greed- black border.exe

installer manager

SETUPPROCESS

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application greed- black border.exe, “·Installer Manager·” by SETUPPROCESS has been detected as adware by 35 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.

File name:

Publisher:

·RapidDown· (signed by SETUPPROCESS)

Product:

installer manager

Description:

·Installer Manager·

Version:

1.0.0.32

MD5:

410263556e410290d9b9bcf0af642523

SHA-1:

6aa890e76720f6fa75dfd459f49d8013140e76a1

SHA-256:

ebd2869d936d5a27c74fd6c6d6e516ce7a79107c8816586f7a267fd7131e2d0e

Scanner detections:

35 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/26/2024 7:15:06 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Bundler.Firseria.1

5594902

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

Unwanted/Win32.Firseriainstaller

2015.05.16

Avira AntiVirus

TR/Dropper.Gen

8.3.1.6

avast!

Win32:Adware-BLW [PUP]

2014.9-150515

AVG

Adware BundleApp.P

2016.0.3108

Bitdefender

Gen:Application.Bundler.Firseria.1

1.0.20.675

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

Application.Win32.FirseriaInstaller.CCE

22127

Dr.Web

Trojan.DownLoader11.3511

9.0.1.0135

Emsisoft Anti-Malware

Gen:Application.Bundler.Firseria

10.0.0.5366

ESET NOD32

Win32/FirseriaInstaller.C potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

Adware/Firseria

5/15/2015

F-Prot

W32/A-fe596ac0

v6.4.7.1.166

F-Secure

Gen:Application.Bundler.Firseria

11.2015-15-05_6

G Data

Gen:Application.Bundler.Firseria

15.5.25

herdProtect (fuzzy)

variant of unconfirmed 713922.crdownload (Adware)

2015.8.12.14

IKARUS anti.virus

PUA.FirseriaInstaller

t3scan.1.8.9.0

K7 AntiVirus

Unwanted-Program

13.183.13642

Kaspersky

not-a-virus:Downloader.Win32.Solimba

14.0.0.2036

Malwarebytes

PUP.Optional.Rapiddown

v2015.05.15.06

MicroWorld eScan

Gen:Application.Bundler.Firseria.1

16.0.0.405

NANO AntiVirus

Trojan.Win32.Morstar.csztiw

0.30.24.1357

Norman

Gen:Application.Bundler.Firseria.1

03.12.2014 13:20:04

nProtect

Trojan-Clicker/W32.Fiseria.214384

15.05.15.01

Panda Antivirus

Trj/Genetic.gen

15.05.15.06

Quick Heal

Trojandownloader.Morstar.O5

5.15.14.00

Reason Heuristics

Threat.Solimba.Bundler

15.5.15.14

Rising Antivirus

PE:PUF.FirseriaInstaller@CV!1.5C42

23.00.65.15513

Sophos

PUA 'Solimba Installer'

5.14

Trend Micro House Call

Possible_GENBUNDLER.UNP

7.2.135

Trend Micro

Possible_GENBUNDLER.UNP

10.465.15

Vba32 AntiVirus

Downware.Morstar

3.12.26.4

VIPRE Antivirus

Threat.4782980

33706

Zillya! Antivirus

Downloader.Morstar.Win32.12

2.0.0.2179

File size:

209.4 KB (214,384 bytes)

Product version:

3.0.26

Original file name:

installer·exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Common path:

C:\users\{user}\downloads\greed- black border.exe

Digital Signature

Signed by:

SETUPPROCESS

Authority:

DigiCert Inc

Valid from:

11/26/2013 10:00:00 PM

Valid to:

12/1/2014 10:00:00 AM

Subject:

CN=SETUPPROCESS, O=SETUPPROCESS, L=Badalona, S=Barcelona, C=ES

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0A8ABFC7C80D0C2F0A3A89CF6139A91D

File PE Metadata

Compilation timestamp:

1/14/2014 1:00:13 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:fZC4Yrkzhw7On+ABGiV15NK6pMNnjkxjR6OusO1w32e4ekHX7FTNrAZ7OmE4It1g:hZYIwCG85HyNnCR6Oa1wmJDFJrW72LU

Entry address:

0x80850

Entry point:

60, BE, 00, 30, 45, 00, 8D, BE, 00, E0, FA, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

184 KB (188,416 bytes)

The file greed- black border.exe has been seen being distributed by the following URL.

http://dl.d0wnpzivrubajjui.com/n/3.0.27.3/.../Greed: Black Border.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/64691757/launch

Remove greed- black border.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.