home

installer_java_portuguese.exe

Meta Installer LLC

This is the Vittalia Filewon Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_java_portuguese.exe by Meta Installer has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the Vittalia DM installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Oracle Java Runtime but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Meta Installer LLC  (signed and verified)

MD5:
06dacc051e2440ac2201c8a7104a21dc

SHA-1:
96d6f6930cb5c36c3698dd2799c7dfce528f5fc8

SHA-256:
ba2368071073f1f87f99b4e014b36cc81fef942d884b5575e9a75fe483b48481

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 4:35:50 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
PUP-gen [PUP]
140813-1

AVG
Generic
2015.0.3365

Dr.Web
infected with Trojan.Packed.28459
9.0.1.05190

ESET NOD32
Win32/InstallCore.QJ (variant)
8.10345

F-Prot
W32/InstallCore.AC.gen
v6.4.7.1.166

Malwarebytes
PUP.Optional.Vittalia
v2014.09.01.12

McAfee
Adware-DomaIQ
5600.7021

Reason Heuristics
PUP.MetaInstaller.Z
14.8.31.20

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Threat.4783262
32210

File size:
878.6 KB (899,720 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Vittalia DM (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\installer_java_portuguese.exe

Digital Signature
Signed by:
Meta Installer LLC

Authority:
Starfield Technologies, Inc.

Valid from:
7/22/2014 8:58:03 AM

Valid to:
2/16/2015 4:59:09 PM

Subject:
CN=Meta Installer LLC, O=Meta Installer LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27C53C6B6DB164

File PE Metadata
Compilation timestamp:
12/5/2009 8:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:fQjgwDtweelCnrPlUeUxRkxY72e5/uJ8B8xpZ1+/WNJTvA:ITSefH8RoY72Uu6B8hgkVA

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

Remove installer_java_portuguese.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.