» hack tool.exe
Overview
Analysis
File Details
Downloads (1)

hack tool.exe

Internal Setup

Condestil Developments s.l.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application hack tool.exe by Condestil Developments s.l has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.dropboxusercontent.com.

File name:

hack tool.exe

Publisher:

The Setup Company (signed by Condestil Developments s.l.)

Product:

Internal Setup

Description:

Setup Process

Version:

3,1,18,1

MD5:

b73decb45ff2e68496b603f1faf4ff13

SHA-1:

582dd4a65f9870322274d713782e9ea3f9be1f3d

SHA-256:

b204c03f82a3ffe6b36605de73357e069b6a1f5ed94d2a7b4c947c0e4d7af0a5

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/26/2024 2:07:31 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Firseria

7.1.1

Avira AntiVirus

APPL/FirseriaM.A.1

7.11.164.240

avast!

Win32:PUP-gen [PUP]

2014.9-140731

Comodo Security

Application.Win32.Firseria.MAP

19049

Dr.Web

Trojan.MulDrop5.34679

9.0.1.0212

ESET NOD32

Win32/FirseriaInstaller.M potentially unwanted application

8.7.0.302.0

G Data

Win32.Application.Morstar

14.7.24

herdProtect (fuzzy)

variant of flv_media_player.exe (Adware)

2014.9.10.20

IKARUS anti.virus

PUA.Optional.Condestil

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.182.12926

Malwarebytes

PUP.Optional.Condestil

v2014.07.31.07

Reason Heuristics

PUP.Installer.CondestilDevelopmentssl.J

14.7.31.23

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.3

VIPRE Antivirus

Threat.4150696

31208

File size:

513.2 KB (525,512 bytes)

Product version:

3.1.20

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\hack tool.exe

Digital Signature

Signed by:

Condestil Developments s.l.

Authority:

Thawte, Inc.

Valid from:

7/24/2014 5:00:00 PM

Valid to:

7/24/2016 4:59:59 PM

Subject:

CN=Condestil Developments s.l., O=Condestil Developments s.l., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

43F850AA43DAD92FF6603BEB72F415DD

File PE Metadata

Compilation timestamp:

7/25/2014 8:19:23 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:nZKdImj6Oifz3Mxr8HGrTmjvqYIhwU3Blka:nZKdH6OifzyffmThTUUa

Entry address:

0xF5DB

Entry point:

E8, BB, 78, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, F8, 03, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 94, 00, 42, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 84, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64... 
[+]

Entropy:

7.6093

Code size:

121 KB (123,904 bytes)

The file hack tool.exe has been seen being distributed by the following URL.

https://dl.dropboxusercontent.com/.../KzlKtkPPeGM7156vdDI5nadYtXrqqLBfuzjCb3miBZORRmUexPEzJaKN1pVzbvB7?dl=1

Remove hack tool.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.