home

installer_whatsapp_+_bluestacks_english.exe

One Installer LLC

This is the Vittalia Filewon Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installer_whatsapp_+_bluestacks_english.exe by One Installer has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Vittalia DM installer. The file has been seen being downloaded from dv.1aab813gfl.com.
Publisher:
One Installer LLC  (signed and verified)

MD5:
545e4388bc1be25f1f64b75a5a8a377a

SHA-1:
f424db2625f626f01643845be047378f26119bb3

SHA-256:
dc078755a98e259b07bc0e60c7d9ac60571100d5bfd3b14feeb280bf68bede30

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/9/2024 7:43:31 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Vittalia (M)
16.7.30.10

File size:
812.2 KB (831,664 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Vittalia DM (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\installer_whatsapp_+_bluestacks_english.exe

Digital Signature
Signed by:
One Installer LLC

Authority:
GoDaddy.com, Inc.

Valid from:
11/6/2013 1:20:03 PM

Valid to:
6/24/2016 1:26:08 PM

Subject:
CN=One Installer LLC, O=One Installer LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
280F69FCB8F054

File PE Metadata
Compilation timestamp:
12/5/2009 8:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:YrE4O4/ESamf/FjvYb+uyjmuvH0qzGhz1DkK:Z4NESxBvYiuy1z4Zk

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installer_whatsapp_+_bluestacks_english.exe has been seen being distributed by the following URL.

http://dv.1aab813gfl.com/installers/axtan_installers/get.php?ne=1&ik=36HlJ5/h8NfauHGI99d2BWW /N WMqjV5HgvPuOExys=&ut=69a65119547f2763c60cac666e850760&aa=lp/1/seo//&ua=chrome&u=vQPR0N6tLf6wzDrTqVe9hOQJHVfQxl8LkBPI/LFt eM3l8LkyAQc3 1ojxF/ N355borzTeTz C7gsagYF8gJg2H6HPpF27k6/8knrJvVRRYILG5MvBvqGOBRjuxL878xSRzW822hnFzRLOf41rTcQXxu1eAz43D11TtH0oTFATTigGtcXTQCe9HXzP96wjHTci8IFdBtnsF6riSrNuOSl/J9iXIRvKCgZgWkHInm9e9OF3AhrmzY7pdSV3Z4tAo//zcGuFlV5NHa5TZnqL4mjA mHb652CSiHd1KuIZldlv8Ua8XgpuwzijdNHrTaBEgsF0ZzaiiipbCTjuZsweqtFb0GPS8K5j1PGuFiROB2iZCOmSPAUNizelNoIgZVIerU4bwEf 1Lt6Ubqcdx0pLThP7O77aA6IX9sEMTEwjE=&p=U0VP&x=R9ZctQHiGMl3Cpa0Fncem/7onx KO4b5sIA5E1S2vvidsITwHo2cSmJPq7gVIXd2skTaBUzi9trqVvkk5po4N9S53EIthpd/2jCutqRgIcwKWXyGoiDGexSb2 ZFZ8lqVOjb0iEJYaEBQvPZMkhq/d/ubDWVEn6yZ58OQM9rU 5hoNaUN7FpNB4snJ09u8AyKiW/pXM7Ym9sZntCsAk2QGQUAsTwSybOqB5mimBGABhpr7HmX7WAE72iZf9oqL2BmjPwPQ9/C5WljnwkGX6yPcLsjv2dAVfx/.../AYLmpM7kGE5f0xxbJXBA==&loop=0&s=&popito=1

Remove installer_whatsapp_+_bluestacks_english.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.