home

herdprotect.exe

Apps Installer SL

Warning, this is an illegal version of herdProtect (repackaged and distributed without Reason Software Company's permission) by a company (Apps Installer SL) that bundles adware. Please make sure that you uninstall this version and download a legitimate copy from our site.
This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application herdprotect.exe by Apps Installer SL has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.
Publisher:
Apps Installer  (signed by Apps Installer SL)

Description:
install

Version:
3.1.10.22

MD5:
c6f37cd3608d1f175b4930c7842409ff

SHA-1:
3861ddd00529bc0868369e1abda193ecf272e450

SHA-256:
772b66b7343ad3dbc2ce7990329f60e3ae537645aac07098efecfcc2f0bad692

Scanner detections:
20 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 8:21:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Jaik.1395
1022

Agnitum Outpost
PUA.Firseria
7.1.1

AhnLab V3 Security
PUP/Win32.FirseriaInstaller
14.04.19

avast!
Win32:Installer-AR [PUP]
2014.9-140419

AVG
Dropper.Generic9
2015.0.3500

Bitdefender
Gen:Variant.Jaik.1395
1.0.20.545

Emsisoft Anti-Malware
Gen:Variant.Jaik.1395
8.14.04.20.11

ESET NOD32
Win32/FirseriaInstaller (variant)
8.9692

F-Secure
Gen:Variant.Jaik.1395
11.2014-19-04_7

G Data
Win32.Application.Morstar
14.4.24

herdProtect (fuzzy)
variant of quicktime(1).exe (Adware)
2014.7.7.10

K7 AntiVirus
Trojan
13.176.11784

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.07.07.10

MicroWorld eScan
Gen:Variant.Jaik.1395
15.0.0.327

Panda Antivirus
Trj/Genetic.gen
14.07.07.10

Reason Heuristics
PUP.AppsInstallerSL.L
14.8.1.0

Rising Antivirus
PE:Malware.FirseriaInstaller!6.17AF
23.00.65.14417

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.26.0

VIPRE Antivirus
DownloadMR
28298

File size:
498.7 KB (510,680 bytes)

Product version:
3.1.6

Copyright:
Copyright © 2014

Original file name:
install.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\herdprotect.exe

Digital Signature
Signed by:
Apps Installer SL

Authority:
GlobalSign nv-sa

Valid from:
1/24/2014 12:38:03 PM

Valid to:
1/25/2015 12:38:03 PM

Subject:
CN=Apps Installer SL, O=Apps Installer SL, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121CBDE0E20D87673EA3438EEEB8A63BE19

File PE Metadata
Compilation timestamp:
4/16/2014 7:41:44 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:SIhq5mJ4GlJxyX2xtlIk531uV4HAoBjWAxT:SIhq5m/bEmXlZh8V4HTjl9

Entry address:
0xEEE4

Entry point:
E8, B2, 78, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 88, F4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 34, F1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 64, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Code size:
117 KB (119,808 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/12300243/launch

Remove herdprotect.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.