home

java.exe

Clovermedia SL

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application java.exe by Clovermedia SL has been detected as adware by 29 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The installer is marketed through download protals and search ads as the free Oracle Java Runtime but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Clovermedia SL  (signed and verified)

MD5:
ca6705e759cabe5e1e8a3d45307fda97

SHA-1:
81f2fdffaa2db14c4388e4332de728b3958bf8bb

SHA-256:
9d2eed1d5b61e8f804af43c784a4ddc83ac201fcc043f47442357ac2bedcecc5

Scanner detections:
29 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/25/2024 6:28:58 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.380151
948

Agnitum Outpost
PUA.Lollipop
7.1.1

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.150.80

avast!
DomaIQ-CO [PUP]
2014.9-140702

AVG
Adware DomaIQ
2015.0.3426

Bitdefender
Gen:Variant.Application.Bundler.DomaIQ.7
1.0.20.915

Clam AntiVirus
Win.Adware.Domaiq-32
0.98/19086

Dr.Web
Adware.Downware.3587
9.0.1.0183

ESET NOD32
Win32/DomaIQ.BB (variant)
8.9817

F-Prot
W32/A-e390a32b
v6.4.7.1.166

F-Secure
Gen:Variant.Application.Bundler
11.2014-02-07_4

G Data
Gen:Variant.Application.Bundler.DomaIQ
14.7.24

herdProtect (fuzzy)
variant of setup.exe (Adware)
2014.9.5.15

IKARUS anti.virus
AdWare.Lollipop
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.177.12109

Kaspersky
not-a-virus:AdWare.Win32.Lollipop
14.0.0.3623

Malwarebytes
PUP.Optional.DomaIQ
v2014.07.02.09

McAfee
PUP-FJV!B7C73AFE167C
5600.7082

MicroWorld eScan
Gen:Variant.Application.Bundler.DomaIQ.7
15.0.0.549

NANO AntiVirus
Riskware.Win32.Lollipop.cyamlo
0.28.0.59911

Panda Antivirus
PUP/MultiToolbar.A
14.07.02.09

Qihoo 360 Security
Malware.QVM06.Gen
1.0.0.1015

Quick Heal
AdWare.Lollipop.r3 (Not a Virus)
7.14.14.00

Reason Heuristics
PUP.ClovermediaSL.E
14.7.2.9

Rising Antivirus
PE:Malware.DomaIQ!6.1975
23.00.65.14630

Sophos
Generic PUA FN
4.98

Vba32 AntiVirus
AdWare.Lollipop
3.12.26.0

VIPRE Antivirus
DomaIQ
29362

Zillya! Antivirus
Adware.Lollipop.Win32.150
2.0.0.1844

File size:
596 KB (610,280 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\downloads\java.exe

Digital Signature
Signed by:
Clovermedia SL

Authority:
GlobalSign nv-sa

Valid from:
4/29/2014 3:14:21 PM

Valid to:
4/30/2015 3:14:21 PM

Subject:
E=media@clovermediainter.com, CN=Clovermedia SL, O=Clovermedia SL, S=Tenerife, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FAB97DC7FB0477755E47A50ECFDC36A0

File PE Metadata
Compilation timestamp:
5/6/2014 7:19:59 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:NrWMz7BJkvBnft2tvcucO/749Fe3byDiRMv08kH2dcBNvhZt+AQV5E:NaMpynft2txEVh9Bg+AQo

Entry address:
0x4095

Entry point:
E8, 10, 2F, 00, 00, E9, 39, FE, FF, FF, E9, A5, 0F, 00, 00, 3B, 0D, 20, 72, 42, 00, 75, 02, F3, C3, E9, 2F, 38, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 4C, 8E, 42, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 28, 72, 42, 00, 01, 0F, 82, DA, 04, 00...
 
[+]

Entropy:
6.5824

Code size:
108 KB (110,592 bytes)

The file java.exe has been seen being distributed by the following URL.

http://www.upstaradown.com/.../Java.exe

Remove java.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.