» installer_microsoft_office_2010_2010b_spanish.exe
Overview
Analysis
File Details
Network (3)

installer_microsoft_office_2010_2010b_spanish.exe

Vittalia Internet S.L.

This is the Vittalia Filewon Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_microsoft_office_2010_2010b_spanish.exe by Vittalia Internet S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Vittalia DM installer. While running, it connects to the Internet address services.upd4ter.com on port 80 using the HTTP protocol.

File name:

Publisher:

Vittalia Internet S.L. (signed and verified)

MD5:

8ab22e9e53789c11f98f20632d084185

SHA-1:

289598c027b7532b5653ac7a1d757dd93c56ac36

SHA-256:

5fa50a8486a95a88803313c7fbb67b7c5f59cda347c26d062d82af87d2d7b110

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

5/2/2024 1:49:52 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Vittalia (M)

17.2.11.18

File size:

5.2 MB (5,501,824 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Vittalia DM

Common path:

C:\users\{user}\downloads\installer_microsoft_office_2010_2010b_spanish.exe

Digital Signature

Signed by:

Vittalia Internet S.L.

Authority:

GoDaddy.com, Inc.

Valid from:

7/31/2014 8:02:13 AM

Valid to:

2/6/2015 12:02:08 PM

Subject:

CN=Vittalia Internet S.L., O=Vittalia Internet S.L., L=Mostoles, S=Madrid, C=ES

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2786630BF69FCE

File PE Metadata

Compilation timestamp:

7/8/2014 6:25:50 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

Entry address:

0x1C0BB

Entry point:

E8, B7, 9D, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, D5, 43, 00, E8, 6F, 41, 00, 00, E8, 60, 37, 00, 00, 0F, B7, F0, 6A, 02, E8, 4A, 9D, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 48, 68, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Code size:

192.5 KB (197,120 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.uplstatsone.com (93.189.33.84:80)

TCP (HTTP):

Connects to services.upd4ter.com (93.189.33.101:80)

TCP (HTTP):

Connects to media.vitavita.com.es (109.70.128.135:80)

Remove installer_microsoft_office_2010_2010b_spanish.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.