» installer_java_french.exe
Overview
Analysis
File Details
Downloads (1)

installer_java_french.exe

Java

Download Manager

This is part of the Air Installer, a download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_java_french.exe by Download Manager has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the AirInstaller Download Manager installer. With this installer, users are expecting to download the free Oracle Java Runtime but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Download Manager (signed and verified)

Product:

Java

Version:

2.5.0.29

MD5:

f0f16fe4595aade0e1fafc045b1202ea

SHA-1:

c8a65b0dfebcad2292e6f5a475e8bc6bfb9d9d7d

SHA-256:

d4da0cd3e2230f49d8dbfbef2111f1d311eccc9d81f9de5e3163bce626f6ee06

Scanner detections:

24 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

7/1/2025 8:17:30 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Symmi.49926

6470710

AhnLab V3 Security

PUP/Win32.AirAdInstaller

2015.01.30

Avira AntiVirus

ADWARE/Adware.Gen7

7.11.205.220

avast!

Win32:Malware-gen

150126-0

AVG

Generic

2016.0.3215

Bitdefender

Gen:Variant.Adware.Symmi.49926

1.0.20.145

Clam AntiVirus

Win.Adware.Agent-36527

0.98/19992

Comodo Security

Packed.Win32.MUPX.Gen

20886

Dr.Web

Adware.Downware.9668

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Adware.Symmi.49926

9.0.0.4799

ESET NOD32

Win32/AirAdInstaller.E potentially unwanted application

7.0.302.0

F-Secure

Gen:Variant.Adware.Symmi.49926

5.13.68

G Data

Gen:Variant.Adware.Symmi.49926

15.1.25

IKARUS anti.virus

AdWare.AirAdInstaller

t3scan.1.8.6.0

K7 AntiVirus

Unwanted-Program

13.193.14791

Kaspersky

not-a-virus:AdWare.Win32.AirAdInstaller

15.0.0.543

Malwarebytes

PUP.Optional.AirAdInstaller

v2015.01.29.09

MicroWorld eScan

Gen:Variant.Adware.Symmi.49926

16.0.0.87

NANO AntiVirus

Riskware.Win32.AirAdInstaller.dmnhfn

0.30.0.65070

Panda Antivirus

Trj/Genetic.gen

15.01.29.09

Reason Heuristics

PUP.Air Software

15.1.29.9

Vba32 AntiVirus

AdWare.AirAdInstaller

3.12.26.3

VIPRE Antivirus

Threat.4782985

36694

Zillya! Antivirus

Adware.AirAdInstaller.Win32.791

2.0.0.2048

File size:

1 MB (1,078,216 bytes)

Product version:

2.5.0.29

Original file name:

installer_java_French.exe.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

AirInstaller Download Manager

Language:

English (United States)

Common path:

C:\users\{user}\downloads\installer_java_french.exe

Digital Signature

Signed by:

Download Manager

Authority:

VeriSign, Inc.

Valid from:

6/10/2014 2:00:00 AM

Valid to:

7/12/2017 1:59:59 AM

Subject:

CN=Download Manager, O=Download Manager, L=Victoria, S=British Columbia, C=CA

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

6771A39C2739AF7082C1C8D8234BB168

File PE Metadata

Compilation timestamp:

1/16/2015 6:05:57 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:pOBUg125aP8UHJLIf5Ic4G+K/GBQiXGu0KwQaqllywdXDOoqvL:pDg45aP8u62b0KwQHlywdUz

Entry address:

0x34FE90

Entry point:

60, BE, 00, 20, 65, 00, 8D, BE, 00, F0, DA, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA

The file installer_java_french.exe has been seen being distributed by the following URL.

http://jujuju47bd6roko.kacikupareif.info/.../download?p=MATOMY-SDD&trckid=131745|20AW3O1axmRRxX6S1x6cxU1yekwY000.&affid=30679&sdd=1&ce_cid=20AW3O1axmRRxX6S1x6cxU1yekwY000.

Remove installer_java_french.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.