home

imgburn.exe

imgburn

Solimba Aplicaciones S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application imgburn.exe by Solimba Aplicaciones S.L has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from nl3.inncdn.com.
Publisher:
Solimba Aplicaciones S.L.  (signed and verified)

Product:
imgburn

Version:
3.0.0.0

MD5:
17590e591d2fa0104257f07deb0d40db

SHA-1:
966446e5e782bfaf84f2d37ff04059c8c738b391

SHA-256:
369c94c7e8f337fb633a6b10a1e32e79daeae269259a598f3a225df33138cbdc

Scanner detections:
31 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/26/2024 6:49:10 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Solimba.1
911

Agnitum Outpost
Trojan.Adware
7.1.1

AhnLab V3 Security
Trojan/Win32.Agent
2012.09.29

Avira AntiVirus
APPL/Solimba.Gen5
7.11.146.148

avast!
MSIL:Solimba-S [PUP]
2014.9-140501

AVG
AdInstaller.Q
2015.0.3389

Bitdefender
Gen:Variant.Adware.Solimba.1
1.0.20.1095

Clam AntiVirus
WIN.Adware.Solimba-3
0.98/18355

Comodo Security
Application.Win32.Solimba.KX
18196

Dr.Web
Adware.Downware.1021
9.0.1.0121

Emsisoft Anti-Malware
Riskware.Win32.Wrapper.Solimba.AMN
8.14.08.07.09

ESET NOD32
MSIL/Solimba
8.9745

Fortinet FortiGate
Adware/Solimba
5/1/2014

F-Prot
W32/Solimba.B.gen
v6.4.6.5.141

F-Secure
Gen:Variant.Adware.Solimba.1
11.2014-07-08_5

G Data
Gen:Variant.Adware.Solimba
14.8.22

IKARUS anti.virus
Win32.SuspectCrc
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.160.8220

Kaspersky
not-a-virus:AdWare.MSIL.Solimba
14.0.0.3440

Malwarebytes
PUP.Offerware
v2014.08.07.09

MicroWorld eScan
Gen:Variant.Adware.Solimba.1
15.0.0.657

NANO AntiVirus
Riskware.Win32.Downware.cthmrb
0.28.0.59608

nProtect
Trojan/W32.Agent.178648.B
13.02.15.02

Reason Heuristics
PUP.SolimbaAplicacionesSL.H
14.8.7.21

Rising Antivirus
PE:PUF.FirseriaInstaller@CV!1.5C42
23.00.65.14429

Sophos
DownloadMR
4.98

SUPERAntiSpyware
Adware.Downware
10632

Trend Micro House Call
TROJ_GEN.RCBZ1B2
7.2.219

Trend Micro
TROJ_GEN.RCBZ1B2
10.465.07

Vba32 AntiVirus
Downware.Morstar
3.12.26.0

VIPRE Antivirus
DownloadMR
28746

File size:
144.6 KB (148,104 bytes)

Copyright:
(c) 2010-2013 (201303261514)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\imgburn.exe

Digital Signature
Signed by:
Solimba Aplicaciones S.L.

Authority:
VeriSign, Inc.

Valid from:
5/16/2011 2:00:00 AM

Valid to:
5/16/2013 1:59:59 AM

Subject:
CN=Solimba Aplicaciones S.L., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Solimba Aplicaciones S.L., L=Badalona, S=Barcelona, C=ES

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EE582E26020D5F7632F2BECC6C5BD

File PE Metadata
Compilation timestamp:
3/25/2013 11:36:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
3072:NwBElMHV8XpJ8Cz/sAeDgl1L9MqN+RZpGtEU3cw6fSCtuZmddk1JSpt6XpF6F:NmJHqxAHgjMqN+zpGiU3cwPrZmduW36m

Entry address:
0x333F

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 78, 73, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, B8, 3C, 42, 00, E8, 06, 25, 00, 00, 53, 68, 60, 01, 00, 00, A3, C0, 3B, 42, 00, 8D, 44, 24, 38, 50, 53, 68, 06, 74, 40, 00, FF, 15, 58, 71, 40, 00, 68, 00, 74, 40, 00, 68, C0, 33, 42, 00, E8, F8, 23, 00, 00, FF, 15, B0, 70, 40, 00, 50, BF, 00, 90, 42, 00, 57, E8, E6, 23, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file imgburn.exe has been seen being distributed by the following URL.

http://nl3.inncdn.com/?domain=imgburn&name=ImgBurn&icon=aHR0cDovL3NjcmVlbnNob3RzLm5sLnNmdGNkbi5uZXQvbmwvc2Nybi80NDAwMC80NDU3My9pbWdidXJuLTMtODB4ODAucG5n&url=aHR0cDovL2Rvd25sb2FkLmltZ2J1cm4uY29tL1NldHVwSW1nQnVybl8yLjUuNi4wLmV4ZQ==&os=&lang=nl_NL

Remove imgburn.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.