» installer_java_spanish.exe
Overview
Analysis
File Details

installer_java_spanish.exe

WorldSetup

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_java_spanish.exe by WorldSetup has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the installCore installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. With this installer, users are expecting to download the free Oracle Java Runtime but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

WorldSetup (signed and verified)

MD5:

17a7ded4dc9a20656edaf77c41cfa5a0

SHA-1:

94f84f09134d45a8e20078f066181b599299347b

SHA-256:

355b9599302fdea9307e7e1243750efea8ad84a45997f6e42b1f80c1c93c9acd

Scanner detections:

23 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/16/2024 8:47:58 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.134.46

AVG

Trojan horse Ransomer.DBB

2014.0.4015

Comodo Security

Application.Win32.Installcore.BB

17868

Dr.Web

Trojan.Packed.24524

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Zusy.68408

8.14.09.01.12

ESET NOD32

Win32/InstallCore.JE.gen potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/InstallCore_JE

9/1/2014

G Data

Win32.Application.InstallCore

14.9.24

IKARUS anti.virus

PUA.OSAppBundler

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11721

Malwarebytes

PUP.Optional.BundleInstaller.A

v2014.09.01.12

McAfee

Artemis!F6314EDD8478

5600.7021

NANO AntiVirus

Riskware.Win32.InstallCore.dcnbpi

0.28.2.60990

Qihoo 360 Security

Win32/Virus.Adware.94c

1.0.0.1015

Reason Heuristics

PUP.WorldSetup.W

14.9.1.0

Sophos

Install Core

4.98

SUPERAntiSpyware

PUP.InstallCore/Variant

10387

Trend Micro House Call

TROJ_GEN.F47V0227

7.2.244

Vba32 AntiVirus

Downware.InstallCore

3.12.24.3

VIPRE Antivirus

InstallCore.b

26980

XVirus List

Win32.Detected

2.7.13

Zillya! Antivirus

Trojan.Kryptik.Win32.492870

2.0.0.1790

File size:

662.6 KB (678,552 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installer_java_spanish.exe

Digital Signature

Signed by:

WorldSetup

Authority:

COMODO CA Limited

Valid from:

1/2/2014 8:00:00 PM

Valid to:

1/3/2015 7:59:59 PM

Subject:

CN=WorldSetup, O=WorldSetup, STREET=Lilienblum 28 St., L=Tel-Aviv, S=Tel-Aviv, PostalCode=6513307, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6EEF11096F7B5CDC42244636F32F2208

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:Ovpgxwq2fo9kt1cJK8D42LltN+lrZ9iPZzVXBlqktRx/Y7Hi/qmRMvyVxlZ:OvmKZAWt1CHD42UlWlB8kt3/8H/4Mvu

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8257

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

Remove installer_java_spanish.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.