home

half_acre_hem_instrumental_downloader.exe

Express Files Installer

Faglaro Enterprises Limited

The application half_acre_hem_instrumental_downloader.exe by Faglaro Enterprises Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SimpleFiles installer.
Publisher:
http://www.express-files.com/  (signed by Faglaro Enterprises Limited)

Product:
Express Files Installer

Version:
2,0,0,0

MD5:
11cab333b2ac003e85116e90538e6a24

SHA-1:
3fb325cc2c93afaaa22b72e3b0425c2e1e35030c

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 12:21:11 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Blisbury.FaglaroEnterprises.Bundler (M)
16.1.10.19

File size:
4.5 MB (4,694,136 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.express-files.com/ (C) 2011

Original file name:
ExpressFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Common path:
C:\Documents and Settings\{user}\My documents\downloads\half_acre_hem_instrumental_downloader.exe

Digital Signature
Signed by:
Faglaro Enterprises Limited

Authority:
COMODO CA Limited

Valid from:
12/15/2011 7:00:00 PM

Valid to:
12/15/2012 6:59:59 PM

Subject:
CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET="Konstantinoupoleos, 22", L=Nicosia, S=Aglantzia/Cyprus, PostalCode=2107, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00DD2A4BBB66262A8FB4E084560573E908

File PE Metadata
Compilation timestamp:
1/18/2012 2:50:40 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:W7XVoi2PIBT1WQCxl6gC1OXa2lcYU3Z1ttcIHmBqdi:yp70l6KXDGsIHmkg

Entry address:
0x437842

Entry point:
68, EF, B8, 98, B5, 60, 88, 14, 24, 60, C7, 44, 24, 40, EF, FF, 0B, 8E, E9, C9, 0A, 00, 00, E9, 88, 23, 00, 00, E8, F5, 6E, 00, 00, F5, C6, 04, 24, 42, 30, C0, E8, 92, 6E, 00, 00, 00, 00, 53, 65, 74, 45, 6E, 76, 69, 72, 6F, 6E, 6D, 65, 6E, 74, 56, 61, 72, 69, 61, 62, 6C, 65, 41, 00, 00, 00, 43, 6F, 43, 72, 65, 61, 74, 65, 49, 6E, 73, 74, 61, 6E, 63, 65, 00, C7, 44, 24, 04, EF, FF, 9F, 83, 9C, C7, 44, 24, 04, 70, 2E, 94, 43, 88, 3C, 24, 8D, 64, 24, 04, E9, 0E, 8A, 00, 00, 66, 81, FC, 33, EE, 8B, 3C, 8F, F9...
 
[+]

Entropy:
7.8860  (probably packed)

Code size:
72 KB (73,728 bytes)

Remove half_acre_hem_instrumental_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.