home

install_limewirewin.exe

The executable install_limewirewin.exe has been detected as malware by 3 anti-virus scanners. The program is a setup application that uses the Nullsoft Install System installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from cdn.msdwnld.com.
MD5:
4dd545b2ca7a7763027745976652cbce

SHA-1:
2fd4a22c78438a8fcd755885726b4657586b6582

SHA-256:
c2f27ffee0a8800db288994038e4a8aa33128ecc8a68f4765e68b818eccbf4f4

Scanner detections:
3 / 68

Status:
Malware

Explanation:
This is part of the Crossrider Internet browser extension framework which may modify the user's web browser settings including changing the home and search pages.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
4/26/2024 10:47:33 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Virus.VBS.StartPage!IK
8.16.02.11.02

IKARUS anti.virus
Virus.VBS.StartPage
t3scan.1.1.122.0

Reason Heuristics
Threat.Win.Reputation.IMP
16.12.10.21

File size:
169.5 KB (173,563 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\install_limewirewin.exe

File PE Metadata
Compilation timestamp:
8/30/2011 5:46:02 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.21

CTPH (ssdeep):
3072:KBsB7O1RK7YDkesp1gJO45lIuLtk2VUY2+9ycIKtV/QCsdKoMKzzFaw8DdUOdEzs:KkSK7YQl7Pobk22Y24nF7YlO6v4eev6G

Entry address:
0x4105

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 73, 7A, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 74, 7A, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 74, 7A, 00, 56, A3, 6C, 53, 7A, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8B, 3B, 00, 00, A3, C8, 53, 7A, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, A9, B2, 40, 00, FF, 15, AC, 74, 7A, 00, 83, EC, 14, C7, 44, 24, 04, AA, B2, 40, 00, C7...
 
[+]

Code size:
32.5 KB (33,280 bytes)

The file install_limewirewin.exe has been seen being distributed by the following URL.

http://cdn.msdwnld.com//cache/teiechargr.net/.../install_LimeWireWin.exe

Remove install_limewirewin.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.