home

imgburn.exe

Apps Installer SL

This download manager from Solimba is a 3rd-party setup and install program that bundles a number of adware programs in the installer. The application imgburn.exe by Apps Installer SL has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from www.download366.com. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.
Publisher:
A.P.P.  (signed by Apps Installer SL)

Description:
download manager

Version:
3.1.11

MD5:
2cb5441719d1667344ae544058a9dedc

SHA-1:
f544793a20070f1555bf98fda22b0be182d0f017

SHA-256:
ce6998a2c252c1d7141a20a5d8f6cd684929a0261d9b76abbafd50ffd8399049

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/20/2024 7:03:55 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Firseria
7.1.1

Avira AntiVirus
APPL/Firseria.A.30
7.11.150.160

Comodo Security
Application.Win32.FirseriaInstaller.KFA
18304

Dr.Web
Adware.Downware.3931
9.0.1.0180

herdProtect (fuzzy)
variant of minecraft_code_generator_v5.2.0.exe (Adware)
2015.6.29.16

K7 AntiVirus
Trojan
13.177.12128

Malwarebytes
PUP.Optional.BundleInstall
v2015.06.29.04

McAfee
Artemis!786B26617C9F
5600.6719

Reason Heuristics
PUP.Bundler.Solimba
15.3.24.17

Sophos
Solimba Installer
4.98

Trend Micro House Call
TROJ_GEN.F47V0513
7.2.180

VIPRE Antivirus
Trojan.Win32.Generic
29410

File size:
509.4 KB (521,616 bytes)

Product version:
3.1.13

Copyright:
copyright © 2014

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\imgburn.exe

Digital Signature
Signed by:
Apps Installer SL

Authority:
GlobalSign nv-sa

Valid from:
1/24/2014 8:38:03 AM

Valid to:
1/25/2015 8:38:03 AM

Subject:
CN=Apps Installer SL, O=Apps Installer SL, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121CBDE0E20D87673EA3438EEEB8A63BE19

File PE Metadata
Compilation timestamp:
5/7/2014 10:02:07 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:Av9RGfqZ2Z3NBDYXZ35g6LyCluJCmAgoV:AvifqZ2voZ35g6Lo0ge

Entry address:
0xE9FD

Entry point:
E8, B9, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 78, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 20, E1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Entropy:
7.6693

Code size:
116 KB (118,784 bytes)

The file imgburn.exe has been seen being distributed by the following URL.

http://www.download366.com/imgburn/download/.../49

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/58262325/launch

Remove imgburn.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.