» lara adrian ebooks.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

lara adrian ebooks.exe

Stas Kosmov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application lara adrian ebooks.exe, “Installer for Application fields Software” by Stas Kosmov has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

Application fields Software (signed by Stas Kosmov)

Product:

Application fields Software

Description:

Installer for Application fields Software

Version:

2014.6.2.1205

MD5:

dc68befc1f0502a122d3becc5bfda654

SHA-1:

b338daafb99aa754f0abe4c1cde23c0b79b7f9e1

SHA-256:

2f3ac1ef526f67bc378100425ab48b16e73f0cfc556357e9eda3a90be20f849c

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/25/2024 6:55:49 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11443296

5805142

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.11.20

Avira AntiVirus

TR/Visucius.20

7.11.187.160

avast!

Win32:InstalleRex-BX [PUP]

141119-1

AVG

Generic

2015.0.3285

Bitdefender

Trojan.Generic.11443296

1.0.20.1620

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Installerex-2

0.98/19672

Comodo Security

Application.Win32.InstalleRex.KG

20137

Dr.Web

Trojan.WebPick.2627

9.0.1.05190

Emsisoft Anti-Malware

Trojan.Generic.11443296

14.11.20

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.4161048

11/20/2014

F-Secure

Trojan.Generic.11443296

11.2014-20-11_5

G Data

Trojan.Generic.11443296

14.11.24

K7 AntiVirus

Unwanted-Program

13.185.14071

Kaspersky

Trojan.Win32.AntiFW

15.0.0.543

Malwarebytes

PUP.Optional.InstalleRex

v2014.11.20.12

McAfee

PUP-FHQ

5600.6941

MicroWorld eScan

Trojan.Generic.11443296

15.0.0.972

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.6.63474

nProtect

Trojan/W32.AntiFW.322616

14.11.19.01

Panda Antivirus

PUP/TSUploader

14.11.20.12

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

11.14.14.00

Reason Heuristics

Adware.WebPick.Installer.S

14.11.20.0

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4150696

34948

Zillya! Antivirus

Trojan.AntiFW.Win32.250

2.0.0.1988

File size:

315.1 KB (322,616 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\lara adrian ebooks.exe

Digital Signature

Signed by:

Stas Kosmov

Authority:

COMODO CA Limited

Valid from:

9/23/2013 8:00:00 PM

Valid to:

9/24/2014 7:59:59 PM

Subject:

CN=Stas Kosmov, O=Stas Kosmov, STREET=Levitana 21, L=Kiev, S=Kiev, PostalCode=03083, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

7A2834207C5588F506D3CF09661E12F2

File PE Metadata

Compilation timestamp:

3/12/2013 4:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:JrYbUzkuvcBYC47l2xSHyxdphxUIdRyZBBMX9v9y8DBMHx:JrdkuveY354dH3diBMX9v9NC

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9551

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file lara adrian ebooks.exe has been seen being distributed by the following URL.

http://applicationgrabb.net/.../Lara Adrian ebooks.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

TCP (HTTP):

Connects to c1.stylezip.info (54.186.255.26:80)

http://c1.stylezip.info/?step_id=1&installer_id=13850222&publisher_id=385&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=41550666&external_id=0&session_id=83101332&hardware_id=96951554&installer_file_name=lara+adrian+ebooks

Remove lara adrian ebooks.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.