home

InstallHelper.dll

ToolbarInnoSetupHelper

First Offer LTD

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The module InstallHelper.dll by First Offer has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
First Offer LTD  (signed and verified)

Product:
ToolbarInnoSetupHelper

Version:
1.0.0.0

MD5:
94eebe6ec52a748fcfcb08841addc603

SHA-1:
8b0d13a57de46eb0366ab19a43fcbd3a85f6b8f6

SHA-256:
28d91ce8ef200b66453f5dea85c1f25cc3a6167ca9cbf35021d21926317d510a

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/25/2024 6:10:11 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Trash.Gen
7.11.30.172

avast!
Win32:InstalleRex-BF [PUP]
2014.9-160214

AVG
Onefloorap
2017.0.2834

Dr.Web
Adware.Plugin.364
9.0.1.045

K7 AntiVirus
Adware
13.194.14927

Reason Heuristics
PUP.WebPick.FirstOffer.Bundler (M)
16.2.14.10

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
9324

File size:
133.6 KB (136,776 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2012

Original file name:
InstallHelper.dll

File type:
Dynamic link library (Win32 DLL)

Bundler/Installer:
WebPick InstalleRex

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\installhelper.dll

Digital Signature
Signed by:
First Offer LTD

Authority:
COMODO CA Limited

Valid from:
10/8/2013 3:00:00 AM

Valid to:
10/9/2014 2:59:59 AM

Subject:
CN=First Offer LTD, O=First Offer LTD, STREET=Habarzel 21 Tel Aviv, L=Tel aviv, S=Israel, PostalCode=69710, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
49900242461D96CB7B045BE0A258338E

File PE Metadata
Compilation timestamp:
9/11/2014 12:09:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:5d6u5x5A/QgBm71lRoh9eSj9RyhHsUVN0YjphI:+u5Xyh9X9YDzI

Entry address:
0x20E5E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
124 KB (126,976 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove InstallHelper.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.