home

iroot.exe

File

conFiRmeD aPP nLN

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application iroot.exe by conFiRmeD aPP nLN has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup.
Publisher:
conFiRmeD aPP nLN  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
05e71f9ae7d38a71ee8acb776acbef13

SHA-1:
522825a00a3b34ea0633dedcebcc0aa18426ef68

SHA-256:
1d26adf2e0eb2ee9f4fb2d4435a30b1506cf53e3f667c6f026d5770e51aee77d

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/25/2024 10:29:49 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.04.02

Avira AntiVirus
PUA/Outbrowse.Gen
3.6.1.96

avast!
PUP-gen [PUP]
150319-1

AVG
Downloader
2016.0.3153

Dr.Web
Trojan.OutBrowse.259
9.0.1.091

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
4/1/2015

McAfee
Artemis!C7E2DB1BB229
5600.6809

Reason Heuristics
PUP.Bundler.Outbrowse
15.4.1.11

Sophos
Generic PUA FN
4.98

Trend Micro House Call
Suspici.9953365D
7.2.91

File size:
1.1 MB (1,102,216 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015Apr01-002900-a23de625-dc21-4402-ba78-6b06bc3441e4.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\iroot.exe

Digital Signature
Signed by:
conFiRmeD aPP nLN

Authority:
thawte, Inc.

Valid from:
3/25/2015 5:00:00 PM

Valid to:
1/27/2016 3:59:59 PM

Subject:
CN=conFiRmeD aPP nLN, O=conFiRmeD aPP nLN, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
561280F42176818265520CB811AC8A9F

File PE Metadata
Compilation timestamp:
3/31/2015 5:29:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:8bSaE4mvt/4kD8Viz/E0OS9h7SqG+YxSn3cQ:8bSv4mvaubGnxo3cQ

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5486

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

Remove iroot.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.