home

installer_utorrent_portuguese.exe

Meta Installer LLC

This is the Vittalia Filewon Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_utorrent_portuguese.exe by Meta Installer has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the Vittalia DM installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from utorrent.begin.pro.
Publisher:
Meta Installer LLC  (signed and verified)

MD5:
2e7c49b8ff66d592c4980d88cbcffe10

SHA-1:
9a52bdb82509a8786a8874af563ff1518b422755

SHA-256:
4b37fd8197350530b9b29162de2c13de273c1589a70c3f614251e299b345270e

Scanner detections:
17 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/1/2024 8:50:04 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
Adware/InstallCore.A.1276
7.11.164.8

AVG
Generic
2015.0.3395

Clam AntiVirus
Win.Adware.Agent-7643
0.98/19185

Comodo Security
Application.Win32.Installcore.SMT
18980

Dr.Web
Threat.Undefined
9.0.1.0213

ESET NOD32
Win32/InstallCore.OU potentially unwanted application
8.7.0.302.0

herdProtect (fuzzy)
variant of installer_adobe_flash_player_portuguese.exe (Adware)
2014.9.11.2

K7 AntiVirus
Trojan
13.181.12846

Malwarebytes
PUP.Optional.InstallCore
v2014.08.01.03

McAfee
Adware-DomaIQ
5600.7051

NANO AntiVirus
Riskware.Win32.InstallCore.dcwlwo
0.28.2.61148

Norman
InstallCore.CERT
11.20140801

Reason Heuristics
PUP.MetaInstaller.DD
14.8.7.21

Sophos
Install Core Click run software
4.98

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Threat.4786888
31208

File size:
880.1 KB (901,248 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Vittalia DM (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\installer_utorrent_portuguese.exe

Digital Signature
Signed by:
Meta Installer LLC

Authority:
Starfield Technologies, Inc.

Valid from:
7/22/2014 12:58:03 PM

Valid to:
2/16/2015 6:59:09 PM

Subject:
CN=Meta Installer LLC, O=Meta Installer LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27C53C6B6DB164

File PE Metadata
Compilation timestamp:
12/5/2009 10:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:9+nhmXsy/m4HHosWpa8jyC8AUt1+/WNJTv3:Ynhny/PHocBgkV3

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9897

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installer_utorrent_portuguese.exe has been seen being distributed by the following URL.

http://utorrent.begin.pro/.../download?p=EXOCLICKworldwide&trckid=NTQ2OTU2fHRoZXBpcmF0ZWJheS5zZXxDUFZ8fDg0NzkxOTJ8YWRleHBydHwxOTUwODV8NTIyNTk3fDQxLjc5LjEyNC4xMXw0NzJ8Nnx8MTI5fDJ8Mnx8MHwyfDEyMHg2MDB8MQ==

Remove installer_utorrent_portuguese.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.