» java_runtime_enviroment_setup.exe
Overview
Analysis
File Details
Downloads (1)

java_runtime_enviroment_setup.exe

Application

OOO Adverts Design

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application java_runtime_enviroment_setup.exe, “Application Setup ” by OOO Adverts Design has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Oracle Java Runtime but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Installer Web software (signed by OOO Adverts Design)

Product:

Application

Description:

Application Setup

Version:

1.2.5.5

MD5:

2f41523080d76bd3ca92b35772a43854

SHA-1:

ba840dc98a32cd89c4e29b9f03b39fd95819c2c0

SHA-256:

8581f164fee4cd25d0a141a83e736cff1c8d36b66e2d43a9d26d953c627a15bf

Scanner detections:

9 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/26/2024 7:08:07 AM UTC (today)

Scan engine

Detection

Engine version

avast!

Malware-gen

2014.9-150327

AVG

InstallCore

2016.0.3061

Bkav FE

W32.HfsAdware

1.3.0.6379

Dr.Web

Trojan.InstallCore.206

9.0.1.086

ESET NOD32

Win32/InstallCore.YK potentially unwanted application

9.7.0.302.0

F-Secure

Adware.BrowseFox.BU

11.2015-02-07_5

herdProtect (fuzzy)

variant of adobe_flash_setup.exe (Adware)

2015.7.2.2

Reason Heuristics

Threat.installCore.Installer

15.4.14.13

VIPRE Antivirus

Threat.4150696

38552

File size:

782.6 KB (801,416 bytes)

Product version:

3.1.7

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\java_runtime_enviroment_setup.exe

Digital Signature

Signed by:

OOO Adverts Design

Authority:

COMODO CA Limited

Valid from:

3/16/2015 12:00:00 AM

Valid to:

3/15/2016 11:59:59 PM

Subject:

CN=OOO Adverts Design, O=OOO Adverts Design, STREET=Ulitsa Borodinskaya 1-ia 19, L=Moscow, S=Moscow, PostalCode=121248, C=RU

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

213B710FCEE68D90F56A8F33AC6451CD

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:B0xpymbFzLmbeAdZCEhKTxyYkqPHMtmElyt452aBGjKwCxVCeeRlh1emn/ch:B0xMWX2dZCI34ZHU8j1emnk

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.6740

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file java_runtime_enviroment_setup.exe has been seen being distributed by the following URL.

http://upgrade4life.theupdatercheck.com/.../vcb Znk3WjrxSZbtnTg=&dist_id=540&channel=ac_j1&cid=14455416511427449171&pubid=366464

Remove java_runtime_enviroment_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.