home

installer.exe

ExpressFiles Application

Faglaro Enterprises Limited

The application installer.exe by Faglaro Enterprises Limited has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. The file has been seen being downloaded from express-files.com.
Publisher:
http://www.express-files.com/  (signed by Faglaro Enterprises Limited)

Product:
ExpressFiles Application

Version:
1, 0, 0, 496

MD5:
25d300ba7286cb76d58c2ab25800ec9e

SHA-1:
387e1ab2cd0e6050459d269695ddb925f666ab1d

SHA-256:
71298aafa36e648ecae798563a39f2f1246c3ecafd07e1297a2defc8e359f0e9

Scanner detections:
33 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/24/2024 10:50:32 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.426646
381

AhnLab V3 Security
PUP/Win32.ExpressFiles
2013.11.02

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.110.152

avast!
Win32:Downloader-TSH [PUP]
2014.9-160120

AVG
MalSign.Faglaro Enterprises Limited
2017.0.2859

Baidu Antivirus
PUA.Win32.ExpressDownloader
4.0.3.16120

Bitdefender
Gen:Variant.Adware.Kazy.426646
1.0.20.100

Bkav FE
W32.Clod935.Trojan
1.3.0.4613

Clam AntiVirus
Win.Adware.Agent-8641
0.98/21411

Comodo Security
UnclassifiedMalware
19383

Dr.Web
Adware.Downware.1440
9.0.1.020

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.426646
8.16.01.20.02

ESET NOD32
Win32/ExpressFiles.B potentially unwanted application
10.7.0.302.0

Fortinet FortiGate
Riskware/ExpressFiles
1/20/2016

F-Prot
W32/ExpressFiles.A.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Kazy.426646
11.2016-20-01_4

G Data
Win32.Application.ExpressFiles
16.1.24

IKARUS anti.virus
PUA.ExpressFiles
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.177.11984

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.790

Malwarebytes
PUP.Optional.ExpressFiles.A
v2016.01.20.02

McAfee
PUP-FJJ!FD90B2D4980C
5600.6515

Microsoft Security Essentials
Threat.Undefined
1.187.2279.0

MicroWorld eScan
Gen:Variant.Adware.Kazy.426646
17.0.0.60

NANO AntiVirus
Riskware.Win32.Babylon.craswq
0.28.0.57029

Norman
Gen:Variant.Application.Kazy.133001
11.20160120

Reason Heuristics
PUP.Blisbury.FaglaroEnterprises.Bundler (M)
16.1.20.2

Rising Antivirus
PE:PUF.ExpressFiles!1.9E64
23.00.65.16118

Sophos
Express Files
4.98

Trend Micro House Call
TROJ_GEN.F47V0430
7.2.20

Vba32 AntiVirus
Downloader.Agent
3.12.24.3

VIPRE Antivirus
ExpressFiles Installer
28884

Zillya! Antivirus
Trojan.Black.Win32.19685
2.0.0.2099

File size:
8.2 MB (8,606,856 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.express-files.com/ (C) 2012

Original file name:
ExpressFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer.exe

Digital Signature
Signed by:
Faglaro Enterprises Limited

Authority:
COMODO CA Limited

Valid from:
12/12/2012 10:00:00 PM

Valid to:
12/13/2015 9:59:59 PM

Subject:
CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
37B080A790663B8AF63D05448AD0343B

File PE Metadata
Compilation timestamp:
7/7/2014 11:52:52 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
196608:VV/M2Za8mcmUM6+76mjWhNXfTU3Na1LWSRA5THfO4qZ+J:VV/HRmR5kNXfQdaRRRA9Hfg+

Entry address:
0x3760E

Entry point:
E8, FD, E1, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C8, 7A, 46, 00, E8, 3C, 77, 00, 00, E8, 3A, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, 90, E1, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 60, 9E, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
338.5 KB (346,624 bytes)

The file installer.exe has been seen being distributed by the following URL.

http://express-files.com/EFinstaller.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.