home

hoolapp.exe

Hoolapp

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application hoolapp.exe by Hoolapp has been detected as adware by 2 anti-malware scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Hoolapp Android’. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Hoolapp  (signed and verified)

MD5:
2954aca20faf2022fad311dac4a973ef

SHA-1:
569fc7c4f584c30f2b137b49b8df44ffc418a547

SHA-256:
617ed44d6d45e0fafea43c55b81059d38a3b73868be8350ba573a18f20cc206c

Scanner detections:
2 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/26/2024 3:25:47 AM UTC  (today)

Scan engine
Detection
Engine version

Malwarebytes
PUP.Optional.InstallCore.A
v2014.01.10.12

Reason Heuristics
PUP.Startup.Hoolapp.H
14.4.12.20

File size:
2.6 MB (2,692,432 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\hoolappforandroid\hoolapp.exe

Digital Signature
Signed by:
Hoolapp

Authority:
COMODO CA Limited

Valid from:
11/20/2012 1:00:00 AM

Valid to:
11/21/2015 12:59:59 AM

Subject:
CN=Hoolapp, O=Hoolapp, STREET=63 Rothschild Blvd., L=Tel-Aviv, S=NA, PostalCode=65785, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1205B27293082834E7A5D38AE9D121B7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:zbYI/namGlhRA0K/V+sgpAQQ+jjXhISfO6+YVAlr3WYmsl87ZOD72XQA7mJQVa9l:fslhREN+PH3h+6+YVAlH07ZOcL7aQVUl

Entry address:
0xD4F30

Entry point:
55, 8B, EC, 83, C4, F0, B8, 18, CC, 40, 00, E8, 0E, F7, FF, FF, 46, 00, 8B, C0, FF, 25, 84, 41, 46, 00, 8B, C0, FF, 25, 80, 41, 46, 00, 8B, C0, FF, 25, 7C, 41, 46, 00, 8B, C0, FF, 25, 78, 41, 46, 00, 8B, C0, FF, 25, 74, 41, 46, 00, 8B, C0, FF, 25, 70, 41, 46, 00, 8B, C0, FF, 25, 6C, 41, 46, 00, 8B, C0, FF, 25, 68, 41, 46, 00, 8B, C0, FF, 25, 64, 41, 46, 00, 8B, C0, FF, 25, 60, 41, 46, 00, 8B, C0, FF, 25, 5C, 41, 46, 00, 8B, C0, FF, 25, 58, 41, 46, 00, 8B, C0, FF, 25, C4, 41, 46, 00, 8B, C0, FF, 25, 54, 41...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
858 KB (878,592 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Hoolapp Android

Command:
"C:\users\{user}\appdata\roaming\hoolap~1\hoolapp.exe" \minimized


Remove hoolapp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.