home

installer.exe

ExpressFiles Application

Faglaro Enterprises Limited

The application installer.exe by Faglaro Enterprises Limited has been detected as adware by 30 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. The file has been seen being downloaded from www.goforfiles.com and multiple other hosts. While running, it connects to the Internet address ocsp.comodoca.com on port 80 using the HTTP protocol.
Publisher:
http://www.express-files.com/  (signed by Faglaro Enterprises Limited)

Product:
ExpressFiles Application

Version:
1, 0, 0, 496

MD5:
dc60fe5e98dc602c589a0e1d11ef3ac4

SHA-1:
284b0e9058d39bfda137d54ec9e8ec542238e2a5

SHA-256:
361ad4e64628f34039610e560e3ec4da3f7fba52b69bc231d9c9d95a3c713157

Scanner detections:
30 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 10:20:20 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.426646
860

AhnLab V3 Security
PUP/Win32.ExpressFiles
2013.11.02

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.110.152

avast!
Win32:Downloader-TSH [PUP]
2014.9-140927

AVG
Faglaro Enterprises Limited
2015.0.3338

Baidu Antivirus
PUA.Win32.ExpressDownloader
4.0.3.14927

Bitdefender
Gen:Variant.Kazy.426646
1.0.20.1350

Bkav FE
W32.Clod935.Trojan
1.3.0.4613

Clam AntiVirus
Win.Adware.Agent-8641
0.98/21411

Dr.Web
Adware.Downware.1440
9.0.1.0270

Emsisoft Anti-Malware
Gen:Variant.Kazy.426646
8.14.09.27.02

ESET NOD32
Win32/ExpressFiles.B potentially unwanted application
8.7.0.302.0

Fortinet FortiGate
Riskware/ExpressFiles
9/27/2014

F-Prot
W32/ExpressFiles.A.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Kazy.426646
11.2014-27-09_7

G Data
Win32.Application.ExpressDownloader
14.9.24

herdProtect (fuzzy)
variant of uninstall3298115.exe (Adware)
2014.12.9.5

IKARUS anti.virus
PUA.ExpressFiles
t3scan.1.7.8.0

K7 AntiVirus
Unwanted-Program
13.183.13504

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3187

Malwarebytes
PUP.Optional.ExpressFiles.A
v2014.09.27.02

McAfee
Artemis!DC60FE5E98DC
5600.6994

MicroWorld eScan
Gen:Variant.Kazy.426646
15.0.0.810

NANO AntiVirus
Riskware.Win32.Babylon.craswq
0.28.0.57029

Reason Heuristics
PUP.FaglaroEnterprisesLimited.J
14.9.27.14

Rising Antivirus
PE:PUF.ExpressFiles!1.9E64
23.00.65.14925

Sophos
Express Files
4.98

Trend Micro House Call
TROJ_GEN.F47V0430
7.2.270

Vba32 AntiVirus
Downloader.Agent
3.12.24.3

VIPRE Antivirus
Threat.4783941
32210

File size:
8.2 MB (8,606,200 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.express-files.com/ (C) 2012

Original file name:
ExpressFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer.exe

Digital Signature
Signed by:
Faglaro Enterprises Limited

Authority:
COMODO CA Limited

Valid from:
12/12/2012 6:00:00 PM

Valid to:
12/13/2015 5:59:59 PM

Subject:
CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
37B080A790663B8AF63D05448AD0343B

File PE Metadata
Compilation timestamp:
7/7/2014 9:52:52 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
196608:AV/M2Za8mcmUM6+76mjWhNXfTU3Na1LWSRA5THfO4qZ+3:AV/HRmR5kNXfQdaRRRA9Hfgo

Entry address:
0x3760E

Entry point:
E8, FD, E1, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C8, 7A, 46, 00, E8, 3C, 77, 00, 00, E8, 3A, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, 90, E1, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 60, 9E, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.9340  (probably packed)

Code size:
338.5 KB (346,624 bytes)

The file installer.exe has been seen being distributed by the following 2 URLs.

http://www.goforfiles.com/installer.exe

http://software-files-a.cnet.com/s/software/13/81/65/.../Installer.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ocsp.comodoca.com  (178.255.83.1:80)

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.