home

installer.exe

Downloadcentral ApS

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer.exe by Downloadcentral ApS has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer.
Publisher:
Downloadcentral ApS  (signed and verified)

MD5:
378f0c50da5e856228620a724b359d0d

SHA-1:
b477c941982786f94dd9d54303b89ba020c3d260

SHA-256:
8b303ab0571b47909ced6d38b7597b2e2a342bc980be410fb195acad8e68d54a

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/18/2024 12:00:12 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.Downloadcentral (M)
16.1.30.13

File size:
1.1 MB (1,103,488 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore

Common path:
C:\users\{user}\downloads\installer.exe

Digital Signature
Signed by:
Downloadcentral ApS

Authority:
VeriSign, Inc.

Valid from:
7/9/2012 5:00:00 PM

Valid to:
7/10/2013 4:59:59 PM

Subject:
CN=Downloadcentral ApS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Downloadcentral ApS, L=Odense, S=Odense, C=DK

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3E0CD42145109655AB37716301DF2ABC

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ndq4SvUa2MJIVs2SlQpaWxRxAXjK7h/c9Yf9wY74khNCOBRCMe5Pjn:nUZ4MP2SlQpaWxRxAXjK7h/sYft740T2

Entry address:
0xCD420

Entry point:
55, 8B, EC, 83, C4, F0, B8, 20, 1D, 41, 00, E8, 4E, F5, FF, FF, C0, FF, 25, DC, E1, 46, 00, 8B, C0, FF, 25, D8, E1, 46, 00, 8B, C0, FF, 25, D4, E1, 46, 00, 8B, C0, FF, 25, D0, E1, 46, 00, 8B, C0, FF, 25, CC, E1, 46, 00, 8B, C0, FF, 25, C8, E1, 46, 00, 8B, C0, FF, 25, C4, E1, 46, 00, 8B, C0, FF, 25, C0, E1, 46, 00, 8B, C0, FF, 25, BC, E1, 46, 00, 8B, C0, FF, 25, B8, E1, 46, 00, 8B, C0, FF, 25, B4, E1, 46, 00, 8B, C0, FF, 25, F4, E1, 46, 00, 8B, C0, FF, 25, B0, E1, 46, 00, 8B, C0, FF, 25, F0, E1, 46, 00, 8B...
 
[+]

Entropy:
6.9268

Developed / compiled with:
Microsoft Visual C++

Code size:
837.5 KB (857,600 bytes)

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.