» java_updater_setup.exe
Overview
Analysis
File Details
Downloads (1)

java_updater_setup.exe

Fileprotected

This is published and distributed via an Adknowledge's advertising supported (adware) software installer. The application java_updater_setup.exe, “Software Installer ” by Fileprotected has been detected as adware by 40 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from secure.5-pn-installer.com.

File name:

Publisher:

Software Installer (signed by Fileprotected)

Product:

Software Installer

Description:

Software Installer

Version:

2.4.8.1

MD5:

37a8a6ef34a1926a2e2247d72d169053

SHA-1:

52900f722f73dfb7076aadd54fd8b0e1aeac7753

SHA-256:

24d61261a3f2145fb996409d43122b7ab0ae37412055767d935685da3c76e22a

Scanner detections:

40 / 68

Status:

Adware

Explanation:

This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/25/2024 8:27:50 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Strictor.69779

796

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

Adware/Win32.IBryte

2014.11.18

Avira AntiVirus

APPL/OpenInst.peprl

7.11.188.28

avast!

Win32:Rootkit-gen [Rtk]

141119-1

AVG

Fileprotected

2015.0.3283

Baidu Antivirus

Trojan.Win32.Clikug

4.0.3.141130

Bitdefender

Gen:Variant.Adware.Kazy.491026

1.0.20.1670

Clam AntiVirus

Win.Adware.Ibryte-592

0.98/19086

Comodo Security

Application.Win32.Optimum.DS

20156

Dr.Web

Trojan.iBryte.64

9.0.1.0334

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.26

8.14.11.30.07

ESET NOD32

Win32/Adware.iBryte.BR application

7.0.302.0

Fortinet FortiGate

W32/Malware_fam.NB

11/30/2014

F-Prot

W32/A-2b3be3da

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.Kazy.491026

11.2014-30-11_1

G Data

Win32.Adware.IBryte

14.11.24

IKARUS anti.virus

Trojan-Clicker.BFNI

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.185.13853

Kaspersky

not-a-virus:AdWare.Win32.iBryte

14.0.0.2866

Malwarebytes

PUP.Optional.Fusion.A

v2014.11.30.07

McAfee

IBryte-FSO

5600.6939

Microsoft Security Essentials

TrojanClicker:Win32/Clikug.A

1.10401

MicroWorld eScan

Gen:Variant.Adware.Kazy.491026

15.0.0.1002

NANO AntiVirus

Trojan.Win32.Badur.dhhunu

0.28.6.62995

Norman

IBryte.STR

11.20141130

nProtect

Trojan.GenericKD.1618449

14.04.10.01

Panda Antivirus

Trj/Genetic.gen

14.11.22.12

Qihoo 360 Security

Win32/Trojan.Dropper.c9f

1.0.0.1015

Quick Heal

TrojanDownloader.Badur.A5

11.14.14.00

Reason Heuristics

PUP.Installer.Fileprotected.S

14.11.22.0

Rising Antivirus

PE:Malware.iBryte!6.192B

23.00.65.141128

Sophos

Mal/Inject-CEE

4.98

SUPERAntiSpyware

PUP.OptimumInstaller/Variant

10205

Total Defense

Win32/Tnega.WHYEFHC

37.0.11219

Trend Micro House Call

TROJ_CLIKUG.A

7.2.334

Trend Micro

TROJ_CLIKUG.A

10.465.30

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

Threat.4798837

35010

Zillya! Antivirus

Adware.iBryte.Win32.854

2.0.0.1790

File size:

381.9 KB (391,032 bytes)

Product version:

2.4.8.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Adknowledge Fusion

Language:

English (United States)

Common path:

C:\users\{user}\downloads\java_updater_setup.exe

Digital Signature

Signed by:

Fileprotected

Authority:

COMODO CA Limited

Valid from:

7/13/2014 5:00:00 PM

Valid to:

7/14/2015 4:59:59 PM

Subject:

CN=Fileprotected, O=Fileprotected, STREET=4600 Madison Ave FL 10, L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00EFEBA775B69C3717980399C96E5323EC

File PE Metadata

Compilation timestamp:

11/21/2014 1:13:20 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:GuS1RIqljPyPjg7AGsIIDDqZORPc09YX9QwTC:NuRIqljPyPOAnIIPq4TYNVC

Entry address:

0x18D13

Entry point:

E8, 5A, A7, 00, 00, E9, 78, FE, FF, FF, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 84, 96, 43, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 84, 96, 43, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F4, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F... 
[+]

Entropy:

5.8309

Code size:

186 KB (190,464 bytes)

The file java_updater_setup.exe has been seen being distributed by the following URL.

http://secure.5-pn-installer.com/o/.../Java_Updater_Setup.exe

Remove java_updater_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.