home

installer_line_english.exe

Line

Download Assistant

This is part of the Air Installer, a download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_line_english.exe, “Line ” by Download Assistant has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the AirInstaller Download Manager installer. The file has been seen being downloaded from download.filewin.com and multiple other hosts.
Publisher:
Download Assistant   (signed by Download Assistant)

Product:
Line

Description:
Line

Version:
3.0.0.45

MD5:
2f556a0705b3135f6d090cac7356447c

SHA-1:
7e828c814a0d4598c33359d2022effc5ff1a1878

SHA-256:
6e50897f1a4249c0268244144dd8f88041426d58a0e00b9aae2078329cca4592

Scanner detections:
15 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/25/2024 1:09:52 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Downloader.Gen
7.11.200.120

AVG
Generic
2016.0.3234

Bitdefender
Gen:Variant.Symmi.49704
1.0.20.50

Emsisoft Anti-Malware
Gen:Variant.Symmi.49704
9.0.0.4799

ESET NOD32
Win32/DownloadAssistant.A potentially unwanted application
7.0.302.0

F-Secure
Gen:Variant.Symmi.49704
5.13.68

G Data
Gen:Variant.Symmi.49704
15.1.24

K7 AntiVirus
Unwanted-Program
13.190.14599

Malwarebytes
PUP.Optional.DownloadAssistant
v2015.01.10.03

MicroWorld eScan
Gen:Variant.Symmi.49704
16.0.0.30

Panda Antivirus
Trj/Genetic.gen
15.01.10.03

Reason Heuristics
PUP.Installer.DownloadAssistant.W
15.1.10.3

Sophos
PUA 'AirInstaller'
5.09

Total Defense
Win32/Tnega.OcTGPYD
37.0.11377

VIPRE Antivirus
Threat.4782985
36468

File size:
832.3 KB (852,312 bytes)

Product version:
3.0.0.45

Copyright:
(c) Download Assistant

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
AirInstaller Download Manager

Language:
English (United States)

Common path:
C:\users\{user}\downloads\installer_line_english.exe

Digital Signature
Signed by:
Download Assistant

Authority:
VeriSign, Inc.

Valid from:
8/13/2014 10:00:00 AM

Valid to:
8/13/2016 9:59:59 AM

Subject:
CN=Download Assistant, O=Download Assistant, L=Victoria, S=British Columbia, C=CA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6BC405E8AC962C676F54816BCC4D4311

File PE Metadata
Compilation timestamp:
11/7/2014 5:33:13 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:wtA7DFh7016hI38k4ew1LBSj4wQm/1JkqQT:q0ZI3g7LB64wjJG

Entry address:
0x4C6AF

Entry point:
E8, 4E, 1A, 01, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 69, 33, C0, 8A, 44, 24, 08, 84, C0, 75, 16, 81, FA, 80, 00, 00, 00, 72, 0E, 83, 3D, E0, 3D, 4A, 00, 00, 74, 05, E9, B1, 1A, 01, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C, 2B, D1, 88, 07, 83, C7, 01, 83, E9, 01, 75, F6, 8B, C8, C1, E0, 08, 03, C1, 8B, C8, C1, E0, 10, 03, C1, 8B, CA, 83, E2, 03, C1, E9, 02, 74, 06, F3, AB, 85, D2, 74, 0A, 88, 07, 83, C7, 01, 83, EA, 01, 75, F6...
 
[+]

Entropy:
7.0641

Code size:
466.5 KB (477,696 bytes)

The file installer_line_english.exe has been seen being distributed by the following 7 URLs.

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&p=QUxMRklMRVdJTkNPTQ==&loop=5&r=9376855&NM=40&MF=17&IA=75&CA=54&DH=64&KD=1&JF=40&CK=23&GM=3&AH=61&t=1415337463&s=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&loop=4&p=QUxMRklMRVdJTkNPTQ==&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&r=798552&IH=6&NA=84&GJ=19&CB=20&IJ=90&KD=6&BK=99&DB=47&ML=59&CN=93&s=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&p=QUxMRklMRVdJTkNPTQ==&loop=3&r=6543131&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&BJ=72&FG=39&LE=75&JN=21&BG=72&JG=6&LG=54&LN=71&GN=48&s=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&r=4183016&p=QUxMRklMRVdJTkNPTQ==&loop=2&CN=36&ND=33&DC=52&GA=86&JI=85&BH=32&HG=44&HD=91&MG=20&FB=39&s=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&p=QUxMRklMRVdJTkNPTQ==&r=3315888&loop=1&MA=66&LI=31&CC=53&CA=60&LH=70&JC=42&HH=31&EG=75&DG=14&s=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.filewin.com/installers/axtan_installers/get.php?aa=ax/.../&ua=chrome&u=L2Rvd25sb2FkLmZpbGV3aW4uY29tL2luc3RhbGxlcnMvb3V0LzAxMTA2MDExMDcwMTEwOC9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2F4L2FsbGZpbGV3aW5jb20vZW5nbGlzaC9hdS1hZGMvY2hyb21lL2xpbmUvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9haXIvbmEvbmEvaW5zdGFsbGVyX2xpbmVfRW5nbGlzaC5leGU=&p=QUxMRklMRVdJTkNPTQ==&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9heC9hbGxmaWxld2luY29tL2VuZ2xpc2gvYXUtYWRjL2Nocm9tZS9saW5lL2QvNzgyMTk4MDI3ZmM1MDk0YzQ3OWQzZWY5YTQzYjIyYjUvYWlyL25hL25hL2luc3RhbGxlcl9saW5lX0VuZ2xpc2guZXhl&loop=0&s=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://engall.filewin.com/.../download?p=AU-ADC&tmuid=d09bb5cb660df513cd755e96a9abe5a9

Remove installer_line_english.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.