home

installer_microsoft_office_visio_professional_2010_spanish.exe

One Installer LLC

This is the Vittalia Filewon Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_microsoft_office_visio_professional_2010_spanish.exe by One Installer has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Vittalia DM installer. The file has been seen being downloaded from dv.1aab813gfl.com.
Publisher:
One Installer LLC  (signed and verified)

MD5:
fa63d01c11665962ce034c916067dd64

SHA-1:
032339fb6307fe666c5efd8c62cc254922cad506

SHA-256:
d67d2b6d5ce54b538d0c1e2a0c0a13a35760e33ca1b63749c88bed76022dbd9e

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
8/3/2025 8:58:13 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Vittalia.OneInsta.Bundler (M)
16.7.7.20

File size:
812.4 KB (831,920 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Vittalia DM (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\installer_microsoft_office_visio_professional_2010_spanish.exe

Digital Signature
Signed by:
One Installer LLC

Authority:
GoDaddy.com, Inc.

Valid from:
11/6/2013 12:20:03 PM

Valid to:
6/24/2016 12:26:08 PM

Subject:
CN=One Installer LLC, O=One Installer LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
280F69FCB8F054

File PE Metadata
Compilation timestamp:
12/5/2009 7:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:RIenbDFZvDl8fWsb+ugodQBA4RJRnpUBsdmx+XvOgI:aiRZJ8xiuAvZpUBsdU9

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installer_microsoft_office_visio_professional_2010_spanish.exe has been seen being distributed by the following URL.

http://dv.1aab813gfl.com/installers/axtan_installers/get.php?ne=1&ik=36HlJ5/h8NfauHGI99d2BWW /N WMqjV5HgvPuOExys=&ut=b58cad9170c1d8a79f21f452cdf1b7bf&aa=ax/1/mp3//&ua=chrome&u=r5pWbTwis09 bJ8c1l3DEXqEEzCWuzA/nF9HWcOQlc5S5WnOeyCdnIwAqdGDy0i3R94gllbgldrbroCt f418McG0IhxVFWyd19hxoSKTfM47TbDmwtR1S CZvOu8aeugHEslHykUkv4sBuzD8WsRRlVA4XvViafX24n5biJW9jV4kQgNQTwMRBuJsBSGwpErFBZz/T6f DkF/gJb AWcFqaadt/dBqAP3s7Fkp7mPgu aMX76uO5UEmlzmq9iEQsKQUOHX7J52BhQU113Omw4L7EoDxiaAWlEeULDpAukgbXzDl1t3M/5GZbyW3kRCd1fdd6Dd84/ZdTA7UwzuomrVscseXZ8HYHrSmEEbz4ZajwZaB4p8EIYGO64Y3oXOLdgDBG7dYh3698JAhv5NXdsHiKOx6rjLjFYe04vySSmLZdjAdwiOAk3wkitNR9s1ORzPqNJeU1AqCUog2Dw6Bmg==&p=TVAz&x=R9ZctQHiGMl3Cpa0Fncem/7onx KO4b5sIA5E1S2vviZPcoVUJEcc90ZX6yoPZeKcsjH6oO6aRmMOxVkMopuLLD3oJhsJgHR6TAoeg6vuwCpZ1wbcjM0hudYj76LqWpa3OzvwqJ iDwKvxmgtoPVSQQSIaeW32QKnkxJecP6lc/cZfRodMmmLxlRoiE19KsuVclnxV gQzHJxd5G17X93jw1jXkSK X9h/.../V3erMW2pBwq39T xeG5 DdwJ6U Y0Ukpktv3NLUBTe70zo4oTGLTZmhmbH6btItTAiQLVDBqQREZl

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.