home

installer.exe

B1 Free Archiver Installer

Catalina Group Limited

The application installer.exe by Catalina Group Limited has been detected as a potentially unwanted program by 5 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This is the uninstaller utility registered in the Windows Control Panel for the program B1 Free Archiver by Catalina Group Ltd. This file is typically installed with the program B1 Free Archiver by Catalina Group Ltd. The file has been seen being downloaded from b1.org.
Publisher:
Catalina Group Limited  (signed and verified)

Product:
B1 Free Archiver Installer

Version:
2, 5, 29, 0

MD5:
b7243b60caf16a0d6433f65533f55b3a

SHA-1:
0160811e4018643c524309b83546de88dacae236

SHA-256:
db3982e4eff7d7dc27846162e70c41979278961a5a7f4fec1d95bbb5a0afccbb

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 11:50:35 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Backdoor.Bot.135374
8.14.06.06.10

ESET NOD32
Win32/4Shared (variant)
8.9895

McAfee
Artemis!B7243B60CAF1
5600.7107

Rising Antivirus
PE:PUF.4Shared!1.9C25
23.00.65.14604

Trend Micro House Call
TROJ_GEN.F47V0528
7.2.157

File size:
25.4 MB (26,590,704 bytes)

Product version:
2, 5, 29, 0

Copyright:
Copyright (C) 2013

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\b1 free archiver\installer.exe

Digital Signature
Signed by:
Catalina Group Limited

Authority:
GoDaddy.com, Inc.

Valid from:
8/16/2013 5:34:08 PM

Valid to:
9/27/2016 8:56:54 AM

Subject:
CN=Catalina Group Limited, O=Catalina Group Limited, L=Kwun Tong, S=Hong Kong, C=HK

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B8F32520620F6

File PE Metadata
Compilation timestamp:
4/28/2014 7:49:10 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
786432:+vj5Q4yAO/Uu1hIBZby/+EExMD119R8dcTMnGGg:CQ4yrbhIbbnxMh19RKGGg

Entry address:
0x53BE4

Entry point:
E8, 00, DA, 00, 00, E9, 79, FE, FF, FF, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41, FE, 8B, 4C, 24, 04...
 
[+]

Entropy:
7.9894  (probably packed)

Code size:
439 KB (449,536 bytes)

Program Uninstaller
Program name:
B1 Free Archiver

Display publisher:
Catalina Group Ltd

Display version:
1.5.86.4889

Uninstall string:
"D:\Program Files (x86)\B1 Free Archiver\installer.exe" "D:\Program Files (x86)\B1 Free Archiver\uninstall.xml"


The file installer.exe has been discovered within the following program.

B1 Free Archiver  by Catalina Group Ltd
About 5% of users remove it
 
Powered by Should I Remove It?

The file installer.exe has been seen being distributed by the following URL.

http://b1.org/smart-download/0/.../B1FreeArchiver_1.5.64.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.