» k-lite codec pack full.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

k-lite codec pack full.exe

Apps Installer S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application k-lite codec pack full.exe by Apps Installer S.L has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from de.download366.net. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.

File name:

Publisher:

App.install (signed by Apps Installer S.L.)

Description:

setup.manager

Version:

3.1.12.5

MD5:

b2b2b87c8cd063351b053b98a6007f71

SHA-1:

2a625a2986845e4f4669bb2b209a6f496d703c7e

SHA-256:

de2eb66594e99533f41260efd029bb9c0bc1fd2133ac5502e37709e8ab23a5a6

Scanner detections:

17 / 68

Status:

Adware

Explanation:

This is a wrapped installation of legitimate software (without persmission of the developer) and bundles adware such as toolbars and extensions.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/19/2024 11:20:13 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.M

968

Avira AntiVirus

APPL/FirseriaI.A

7.11.153.178

avast!

Win32:Solimba-C [PUP]

2014.9-140612

Bitdefender

Application.Bundler.M

1.0.20.815

Comodo Security

Application.Win32.Firseria.K

18458

Dr.Web

Trojan.MulDrop5.32888

9.0.1.0163

ESET NOD32

Win32/FirseriaInstaller (variant)

8.9907

F-Secure

Application.Bundler.M

11.2014-12-06_5

G Data

Application.Bundler

14.6.24

K7 AntiVirus

Unwanted-Program

13.1712333

Malwarebytes

PUP.Optional.AppsInstaller

v2014.06.12.01

McAfee

Artemis!D5103E38C18A

5600.7102

MicroWorld eScan

Application.Bundler.M

15.0.0.489

Reason Heuristics

PUP.Installer.AppsInstallerSL.W

14.8.7.18

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.0

VIPRE Antivirus

DownloadMR

30028

File size:

497.5 KB (509,416 bytes)

Product version:

3.1.15

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Digital Signature

Signed by:

Apps Installer S.L.

Authority:

Thawte, Inc.

Valid from:

2/19/2013 1:00:00 AM

Valid to:

2/20/2015 12:59:59 AM

Subject:

CN=Apps Installer S.L., O=Apps Installer S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

323F44D66AEF890F43C32CFD743A4AD0

File PE Metadata

Compilation timestamp:

6/3/2014 12:18:13 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:SYYZr6ypt7xGspjYu+Uhx63UXBQddduJDOxeU:SYcr6y/xxsg9BND0eU

Entry address:

0xE05C

Entry point:

E8, 7A, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 38, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, F8, E0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64... 
[+]

Code size:

113.5 KB (116,224 bytes)

The file k-lite codec pack full.exe has been seen being distributed by the following URL.

http://de.download366.net/k-lite-codec-pack-full/download/.../860

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/18893355/launch

Remove k-lite codec pack full.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.