home

installer.exe

B1 Free Archiver Installer

Catalina Group Limited

The executable installer.exe by Catalina Group Limited has been known to be a potentially unwanted program that has been detected by 3 anti-malware scanners. This is the uninstaller utility registered in the Windows Control Panel for the program B1 Free Archiver by Catalina Group Ltd. This file is typically installed with the program B1 Free Archiver by Catalina Group Ltd. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Catalina Group Limited  (signed and verified)

Product:
B1 Free Archiver Installer

Version:
2, 5, 11, 0

MD5:
3b27c2fdeddae4abf9e3953a02cae36e

SHA-1:
be9703c8c52f6ad916014454636709a2caec8511

SHA-256:
4b178eda6962b5ecb343ef568902b4313b65f38f4c3ed5383a73b506294ecdcb

Scanner detections:
3 / 68

Status:
Clean  (3 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
5/6/2024 9:48:43 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Backdoor.Bot.135374
8.14.03.23.02

Rising Antivirus
PE:PUF.4Shared!1.9C25
23.00.65.14321

Trend Micro House Call
TROJ_GEN.F47V0218
7.2.82

File size:
556.5 KB (569,840 bytes)

Product version:
2, 5, 11, 0

Copyright:
Copyright (C) 2013

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\b1 free archiver\installer.exe

Digital Signature
Signed by:
Catalina Group Limited

Authority:
GoDaddy.com, Inc.

Valid from:
8/16/2013 1:34:08 PM

Valid to:
9/27/2016 4:56:54 AM

Subject:
CN=Catalina Group Limited, O=Catalina Group Limited, L=Kwun Tong, S=Hong Kong, C=HK

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B8F32520620F6

File PE Metadata
Compilation timestamp:
2/17/2014 1:38:56 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:rLZb3xCsZGJDSzVMd2qOVeraVlVW2Mlv+Ti4fnoLAsH0SHTku:rVbtZcqVzj42M8Ti40A2hHJ

Entry address:
0x27302

Entry point:
E8, E5, C2, 00, 00, E9, 79, FE, FF, FF, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41, FE, 8B, 4C...
 
[+]

Entropy:
6.3728

Code size:
255 KB (261,120 bytes)

Program Uninstaller
Program name:
B1 Free Archiver

Display publisher:
Catalina Group Ltd

Display version:
1.5.86.4889

Uninstall string:
"C:\Program Files (x86)\B1 Free Archiver\installer.exe" "C:\Program Files (x86)\B1 Free Archiver\uninstall.xml"


The file installer.exe has been discovered within the following program.

B1 Free Archiver  by Catalina Group Ltd
About 5% of users remove it
 
Powered by Should I Remove It?

The file installer.exe has been seen being distributed by the following 16 URLs.

https://dw.uptodown.com/dwn/f4iUzQa-TdJWLGshU2F4VLpT7yK6j7xVBxgpE6V5Xq7RXZwmZkKj2qnQZDuqjbv5vtYb6cmELMcaf0LagRM5cRrwVYxFnrzC6ClXGPTnWI_8xbFBldM_QLnDtJvxRRyu/e7SFdbKHshkSAAZUEn0F1SCMtQpszl7ajW6b7oNK6pZB1f6lN_LvIaJ4CmvnqcgBKUAVERdTrAqIu97ZRIYVDI9ND6GRZmyqXeOCyOlUGNoY0GfMXL3UWWP7mHCxmqFx/87Vkp27mWTJ07TtIV8Yin-qBqLRXqq_A09Nf7LY_THkJJioFbbE76fZ71sWF2kFD2f1c_ydVsDasppdiJ-xlftubKKZpY_2JKAiDU7HP2A2PmPZ3_IIR6X2FrUSMEFHk/.../

https://dw.uptodown.com/dwn/WraASFIrDs9ptOfe4mQeonTiKmAcST-WjkFVU3WHMoFP-mbGaUd88WnLB9A35HtjWbRBbr1tQDKWGshLnB_dRXrDbvnIFqF4qgq4rvUZgNP0VVtxxP7tpwbqSfIZwbUl/W0OvsQY8a98CBOlYqTZ11XZGcTDz3LjoFZ6Jy14HGRKZD7-h4lU_MXqn2PjaBL4TIX5bEVpOXmztBrFSM-MSj9KbX98Krve4cdKQ8CBROMQhnlfnHjY3RerCj1AhVSgs/jgdaj11dFCamywI8hFMn0Ww8YmKT3MiERh51SQ_mPhv1txHZfGUmmo33L1T7EWdq9ukfAyfAw2yrYfOQUhF4cRT6OKd2YGsR2SOSccBW15dkhysqsMYH2IYdRm2_nRta/.../

https://dw.uptodown.com/dwn/UY3c8uNLCN0Xz9DrIlaDDr79GI31N5DskCozg2N2nZmRulyJ0rSf0RBxbb9YUQii4bUjRfKCR6ozcTphZO03cSRK93sfwxzitg8ok3F79GnFWoO-Q0HL2kzo4kzo99o3/lbl23tMQ-fBryLggEAoV1szpOlyyDKFSvWlJqLNmBIUFHmOMI66XJv6iHTCjetaI7vyJRjvGREdCzHnz4Y80hNshuic2ChSd3y7_YFRCefrnMAvxJt204YMVvzTsW9lI/dLAvbvI-xl3X82gjZjsMAhABMWaojI3Qeql9hg-jb5G8iE6KFyJMQDDwYJqZzfjt9JilusN8b-lHADJmhSEX-ZGqeX3e5QcvEKH7IePqnPFuZpqUuwEDq788qd_VM_4M/.../

https://dw.uptodown.com/dwn/B4fgs_H8_hXWo5ym5nqdolZGCBt_5HCwCwOpBoqTcQl11iVStVUdk7Fb5Vg78AViy9IDqRwwN2UqRxOEay-e6yq6bJxc-VXm9mFTCAQI5veRZxWgDTBRtNf4-csa0hUT/lM01AnlM-hNLRtSm30cxllGdRbWk9ts3wRvEWW2AFQDJWjKv3fgC-mZWAaZtNN9KnFLezHowpyrRvJ-ZzSX279mrM7AMAZ1TBmOb2je-wMcVDtbYNX9LaQiRZ3AARLrk/0YtS0JzvBCoW857Lzmh1z-qVO7FX_-feRMSlZVZqqY3BvNn0f_YxRGhpGz-2GJaJH7Fm_CmWsp1vr8jBI19ysSbkPlRXKuPjUlcBZ1Qqe_4j284I2U-QVdfbd9up208L/.../

http://dw.uptodown.com/dwn/hUf26PBbjALI3k2ZtwJap0e1l6tT--UrGsvdvdPFdFBBvDFbWGtxyoKfwhpj4KHin5mvUcj10MA1-XzkG2zAGQ3z3Im8XA8PHnUGdfleumFLS5-3qPoyfriPgT-BYZTl/uopmJaBzKqaY_5kHLGosj9kQLhCt6qeWoz2kH5JdVBrmiUHXHjI9D6H1MQbkmYdpOaYOTUSx54EZDEM9hLmseEX-RxqlKT2_dgpG2OhyhZ8tzwwe7Q1ixbwELzi53Uyo/.../

http://dw.uptodown.com/dwn/1OLGi1-EJLnp2KwUo5XRvaslnZzlXiIkI7cEgxicZqXbeQasEM38F22EShWJL9G2KF0fGTdhiy5Umhfz6xj5BGh1QrAUfxZyO9h_0u3AASu337fydete5UegYMvTcRH-/_J0AErwTyXHg1GShTX_OWp-rICTLd38XigfdrJ3_wwTm8Ty_CEGRmjyR_VJ6WbKeR8pfGdQ26rXztViBSPYi2AELuNBv9pNquhbSthCJQoevu9twayaCeY8H5_tQJoF7/SezBHmIuziPsvzrC2muE1zX19sWN2-jdy2OtbH4EXCiMOgr2XVlPDKw5V9AytXqd1MiYpzKqjgNI-3jcLKLYOZ2gIb31T_KpjH3rcpKVBnqktoFjmfoF12tS_bHsMm32/.../

https://dw.uptodown.com/dwn/wV4OT3FDLpzv1gHwDBs-cInYCca7Sby9OEpsnfTLLBDN8m5AuBGVOJYlWG2mX3o1xFO5mAqP7q6c5r7oyGi_d1Fe1zkVPZ6rVC2XFyJUaRKwrAQhR5r_2YAOqiImzZwE/7dyZTOMaCOJLTZA3sg5oa_rxXpNmLDJ_xQeI12SInaxYrZoW-CLmOnWm_Hb5WWBERxwrdKtAnqtHvPnt6bNPEV-vFbrTu3AIm-n-d0exKjvwzr2FucPFbHhJ7cByjQnN/fl4JBvv2mokagngqWHuwDUeYQACYEZ5WCxx3B-7qp5KlD9S9i2N6d2xIrq9XE6lRsibulyLd0870J6HgK2Rt_fjVDTP5lfa4jS3PoJKXmapIKwOPDsagrAHfoDMDZrG4/.../

http://dw.uptodown.com/dwn/xJW9wJ24fT-DrcAygzUz3yEFMtkzxlC7MRyroVNLtzDYxqu5Xgar5aE5MJlHsycvnT27dUDITptuRspW_-CZ01shKweqlG-qjVlmoM9D4adPev5eXHTlwlrzOxwuVzvs/gLXmW9Elh_oNsAwza_ZF7o8w4h4JIz72BkaJIR9XeboT3KSVtcrbjn_Pk9WmI4b5hAEmczseYTCQzFxYfWJykRv8p3obOmh4fi1HBcvbMdIZn6GEUFl_CbRBX_yS5LdK/aoxYqL6UzPN_P580wj54x1G__TStu69OJUHrDp8GEbsEG3LtuLevAf_V0vKMHr79K2zPEpWnbplnNu_xPBSb25Flp5dDWgo67FzzZOAjPMyuLvcSC9lSrPiCB3LfNSzE/.../

https://dw.uptodown.com/dwn/5fh1-NSFFYVCQ1XqCAReHzZ4suIOb91-mTk9vCiFCemcViHZtsTZdzlnXNV2dQjptGqN_br59R5vYk7ICl_trrxV-HflqeG91s3apOuHCDtNQccDs2osk-eWfSWi0INb/pfShHRfKu4OR1MQsrecegnRCodDfL7iG6hcrse-gL7V8VQCV-JC6Gc8racuvSjED5W-RnDYqUxPiRJjF_8_AvLcwYWuT8HcFZRs8W8IKcrah887f6aohwUCNZueXrB40/JHfCMjD8R-caReabemjhjugP7BorEVHHh76xKggvsPCZ6ADHNIHIMsU5yKADFZ0Oldxu0N4Cu6m-7fEd72Mo2-MYoiwTPWQAXxZq6gXWdnDZElmoGGNnOp6fC8JJL3MQ/.../

https://dw.uptodown.com/dwn/MYNkbyLvigLkfx_0kl_U94n8MF0GT9-AUZ82tshBffCOibpQAd2pVqAXCb7num-R-6UpxKXNSa5EproNhZsOo7Z7VVyhUSXMfNHESe7GRVFBmxKoJB3igBnssg8B_9K9/MY9MWDQ-cSKeZR0PaN1sounVQRA33acVFCm34ahVmDEPIh064VVGzbdspQ6RArGrSN2o686HrUcjMz3WR-GbA1CfSBScXqH1RmPFaSuYaXvAqb2oLXIh7i2oAm5vHKkj/ISB3Z7oxB6S193rfVt8TgQPPQJEAwH62IUVOS6WKlrM3vF60hLHNyKpIC88Sbo-kjkb-i5S1ZBZM3ZimJNCOWGS3_fOKC0O9Dmv1rwJD8BvdCdlC9FKbIzVI7ccyfrNi/.../

http://dw11.uptodown.com/dwn/l6gwuhz7K8zSusY8Cj8N4yfUj6e60NBF_5y4116wtEyFZSplJ1FpB6uQMbSjS_WJI8-E03P0WNhd8GK0IPDHiG8dqaeb836hXNV6CCMVaGp07Mt5ZIHUTdkMpGzZJL3h/Qj6UShSfunfAWSDW0s5k7uLRYultrCulWMrpibDNPQ55I6GvvnV7KJt0XduVdQnXMk-AhH6svWcrHNlmYhYeaTclII84p32R0Dfjg5e0T5Ht1tlhtw6R8zHYZx_eZ9TK/.../b1-free-archiver-1-5-86-en-win.exe

http://dw4.uptodown.com/dwn/bJ3TTcIrhaUTfhmVBldNH2Tw_ORSM0RF-sJlGi6araf0bDXJtuYSuIR0PDZj-RFu9xp2zg7a46-fAlapCIeBTXVI3nWKRKJFOfuMrjMp66ZMqkzEHFJGa3qXEKwx2eoc/cc-tK1IrXOBC_DLdGtYZ-AHG9SFsSZwvxe3PceQ5N0YcJGoTW_UXKKDMf74ptoC1mIPmACJROixMgh35QoaQB4hq5Rj4Aae8FBqP_OQ_ug0FB4qC6VO9h5FL533Tm1gr/l3J33GNtydwr5kTfrM9kgr2WcvC-TfGolK5yEGm7OcKudF4_R-40mK4dM4p6our5lajwE0jX_nhR_h4nEyv8aWRKxJrzph0ic1VYUCLi2f0FPe1vA7cOqXNA_R5MBE1b/.../b1-free-archiver-1-5-86-en-win.exe

http://dw.uptodown.com/dwn/7IE5eQoiVQWcxK_Hgq-5iYBPwke6aq7cJ3U3sRrYAbi4ErFxgnBVVhyO8ITzxr1ZjxS_2yfK3GZXU25vBbPHq9vbgzMOrTNIhwI-3KbOQkaq1VlscaXkmxxcNul3dWmx/8CdAC3d60HuJ3wJmJZtD2jLa98tAC5E5UMuFFJc8W7A6BK8qM-xn4JUXr1RCQ2ag1y2X-VuymXqA9ogdgmMzvYIQtcLNbRWrCc94nY-uSdxwZYT2i4YoYY0pmmSMon_a/.../

http://dw.uptodown.com/dwn/dnGcqmp_i8EKCSXFxZK0VZP9fUbcxyjsc7YdtEj1rguaaTWsPIVAYDR0g51SWHtfif-CL-cd9j1AoxHaoOdrL7Kn7pOSHMXNyDvvY-hvjDr5jp86DZilDIupbKXKmbsz/CLSaepxLAnjXn0cfU4dgr6ELCcRbDGOnmHuJJ7Aikhmjn689ixQ9zvPorGqCfLtMjL3W9rWczSVRMTrEw8kLHnD_iKKqHl4Phr880T0qPs_SZqAnKv4N7pF1-HRns-M5/.../

http://dw.uptodown.com/dwn/zA-yzt5GmPbMdh2cy2jUf8qzAI-lNAY1IcRB8Ks-hVPYFqFRHDBZYVlqXmf07f_oga9t5QLryinyFUrQ4GNZ_DbWxav7RBTsWWyT1bqhLxNAWqEbde3-ERIY8VdTbwn3/iazCSYcYcjnYOvoAzjMm6wccjl3yJpms8uCiM5IPQpq4qA5x5Z4I-vexrEioOljd-vK2zkwQQcHHyM7ieENgwz2yAvU0VAl2q4Qk7wIjR8hCcL_s2-Wsvj8jyGPNU5fu/.../

http://b1.org/smart-download/0/.../B1FreeArchiver_1.5.86.exe

Scan installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.