home

installation.exe

Installation

The application installation.exe has been detected as a potentially unwanted program by 7 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from get.ddlmedia1012.info.
Product:
Installation

Version:
1.9.3.0

MD5:
82d7798ddd9c4d568d5e3cfa15e88365

SHA-1:
61d02304c1579aedf4beaac6b3d90b64b1d77e6c

SHA-256:
49b4f0509a2c5cb3b4162df8a7a7c79f145e1a3b4f9521f5123d1d7510e42483

Scanner detections:
7 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
5/16/2024 1:32:33 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Outbrowse.Gen
7.11.211.180

AVG
Downloader
2016.0.3192

Dr.Web
infected with Trojan.OutBrowse.102
9.0.1.05190

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
2/20/2015

McAfee
Program.Adware-OutBrowse.e
16.8.708.2

Trend Micro House Call
Suspici.A47CB6DA
7.2.51

File size:
1.1 MB (1,124,348 bytes)

Product version:
1.9.3.0

Copyright:
Installation

Original file name:
Ionic.Zip-2015Feb20-181045-7980cffe-7d08-41dd-b282-d657d1e9a35f.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\installation.exe

File PE Metadata
Compilation timestamp:
2/20/2015 8:10:45 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:sMiy4IadS4ms5I6e66fEheKhAs+qADrINxWnDecJQ7xF+R1PMRPb+3BMqh/DHVDw:sbSaE4mvt/d2ADrA0C2Q7xFgdpzgM1FO

Entry address:
0x7604E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464.5 KB (475,648 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://get.ddlmedia1012.info/.../Get?p=13073&d=24877&l=3325&n=0&d1=NUMBER&clickid=FT108Dypzj

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.