» harold and kumar escape from guantanamo bay.exe
Overview
Analysis
File Details
Network (2)

harold and kumar escape from guantanamo bay.exe

Lior Sela

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application harold and kumar escape from guantanamo bay.exe, “Installer for StarApp” by Lior Sela has been detected as adware by 30 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

StarApp (signed by Lior Sela)

Product:

StarApp

Description:

Installer for StarApp

Version:

2013.5.1.1725

MD5:

199ab50f631eea50cdef671b7c6ed253

SHA-1:

8057509fbf1a04271d09e7e3fb2b845597fdd050

SHA-256:

fd4e5821dfaa86a680937a60530abd73218dbd7a23011dbfec0f56cc5463d8cc

Scanner detections:

30 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

5/8/2024 6:39:47 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Generic.487482

974

AhnLab V3 Security

PUP/Win32.TSULoader

2014.06.06

Avira AntiVirus

ADWARE/InstallRex.Gen

7.11.153.72

avast!

Win32:InstalleRex-Q [PUP]

140531-1

AVG

Skodna.Pick

2015.0.3452

Bitdefender

Adware.Generic.487482

1.0.20.780

Bkav FE

HW32.CDB

1.3.0.4959

Comodo Security

Application.Win32.InstalleRex.KG

18446

Dr.Web

Adware.Downware.1166

9.0.1.05190

Emsisoft Anti-Malware

Adware.Generic.487482

8.14.06.05.06

ESET NOD32

Win32/InstalleRex.J potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

6/5/2014

F-Secure

Adware.Generic.487482

11.2014-05-06_5

G Data

Adware.Generic.487482

14.6.24

IKARUS anti.virus

PUP.InstallRex

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.1712319

Kaspersky

not-a-virus:AdWare.Win32.Agent

15.0.0.463

Malwarebytes

PUP.Optional.Installex

v2014.06.05.06

McAfee

PUP-FHQ!199AB50F631E

5600.7108

MicroWorld eScan

Adware.Generic.487482

15.0.0.468

NANO AntiVirus

Riskware.Win32.Agent.crfikv

0.28.0.60100

Panda Antivirus

PUP/TSUploader

14.06.05.06

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.B5

6.14.14.00

Reason Heuristics

Adware.WebPick.Installer.l

14.8.7.21

Rising Antivirus

PE:Malware.Agent!6.25

23.00.65.14603

Sophos

InstallRex

4.98

SUPERAntiSpyware

PUP.InstallRex/Variant

10561

Vba32 AntiVirus

Downware.TSU

3.12.26.0

VIPRE Antivirus

Threat.4753027

29800

File size:

284.9 KB (291,720 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\harold and kumar escape from guantanamo bay.exe

Digital Signature

Signed by:

Lior Sela

Authority:

COMODO CA Limited

Valid from:

1/22/2013 12:00:00 AM

Valid to:

1/22/2014 11:59:59 PM

Subject:

CN=Lior Sela, O=Lior Sela, STREET=Moshe Sharet 46, L=Beer Sheva, S=Beer Sheva, PostalCode=84786, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D39C56B89258E40E737B2AEDA8D3D3E5

File PE Metadata

Compilation timestamp:

3/12/2013 8:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:mrk96Y0JQBkQRl7174NpNUM+UHs+8/NaAgOkvuXBehFmU07sBm8GfBpO10:mrk963yRl1uqM+gs+84CkvmPA10

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9538

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

TCP (HTTP):

Connects to c1.stylezip.info (54.186.255.26:80)

http://c1.stylezip.info/?step_id=1&installer_id=6219484&publisher_id=219&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=18658452&external_id=0&session_id=37316904&hardware_id=43536388&installer_file_name=harold+and+kumar+escape+from+guantanamo+bay

Remove harold and kumar escape from guantanamo bay.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.