» myegy.com.p.s.7.by.g_me.on.part2.rar.exe
Overview
Analysis
File Details
Downloads (4)
Network (1)

myegy.com.p.s.7.by.g_me.on.part2.rar.exe

Shlomy Golani

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application myegy.com.p.s.7.by.g_me.on.part2.rar.exe, “Installer for SummerSoft” by Shlomy Golani has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

SummerSoft (signed by Shlomy Golani)

Product:

SummerSoft

Description:

Installer for SummerSoft

Version:

2013.9.24.1628

MD5:

0e443e86911ca0d2da39dab7e10d9170

SHA-1:

0068631669130ed3ff160867e887b1c7e06d3384

SHA-256:

439f364bb6fb592085c4d2d3a3a609458d14aaa6d3bd37bfe1f79a8f3c8234e3

Scanner detections:

26 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/26/2024 7:52:32 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.08.28

Avira AntiVirus

Adware/InstallRex.2

7.11.169.164

avast!

Win32:InstalleRex-AH [PUP]

2014.9-140809

AVG

Generic

2015.0.3387

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Comodo Security

Application.Win32.InstalleRex.KG

19338

Dr.Web

Adware.Downware.1541

9.0.1.0221

ESET NOD32

Win32/InstalleRex.K potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

8/9/2014

F-Prot

W32/InstallRex.B

v6.4.6.5.141

G Data

Win32.Application.InstalleRex

14.8.24

herdProtect (fuzzy)

variant of i.hr.yr.vce.e01.130605.hdtv.h264.450p-kor.dramadownload.net.rar.exe (Adware)

2014.10.10.19

IKARUS anti.virus

PUA.InstallRex

t3scan.1.7.5.0

K7 AntiVirus

Unwanted-Program

13.183.13166

Kaspersky

Trojan.Win32.AntiFW

14.0.0.3431

Malwarebytes

PUP.Optional.Installrex

v2014.08.09.05

McAfee

PUP-FHQ

5600.7043

NANO AntiVirus

Riskware.Win32.Downware.crurlx

0.28.2.61861

Panda Antivirus

PUP/TSUploader

14.08.09.05

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

8.14.14.00

Reason Heuristics

Adware.WebPick.Installer.BB

14.8.9.17

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4753027

32210

File size:

320.7 KB (328,376 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\myegy.com.p.s.7.by.g_me.on.part2.rar.exe

Digital Signature

Signed by:

Shlomy Golani

Authority:

COMODO CA Limited

Valid from:

1/17/2013 4:00:00 AM

Valid to:

1/18/2014 3:59:59 AM

Subject:

CN=Shlomy Golani, O=Shlomy Golani, STREET=Wingate 56, L=Beer Sheva, S=Beer Sheva, PostalCode=84428, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

009FC86200EC0FF58D1C39395238030858

File PE Metadata

Compilation timestamp:

3/12/2013 12:51:45 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:Irwr6Y0JQBkQRl7174NpNUM+UHs+2rRDRONSxxh7xzd2286AI3hGyMO:Irc63yRl1uqM+gs+oRROwxxpxxvAwhGE

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9545

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file myegy.com.p.s.7.by.g_me.on.part2.rar.exe has been seen being distributed by the following 4 URLs.

http://www.safecanadapro.info/v298/?product_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&filesize=82.95 MB&product_title=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&installer_file_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&product_file_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&product_download_url=http://www.ziddu.com/store/temp2/temp1/temp3/2010-3-25/D//1269527939_MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&uuid=xLKAW33s19MrhUER9XR0S7tADbtoaM9aAm2Tk0DIsd5F5ILV7ACg3GskSafY30Rh7Yk8gxRXH4ewkqxy3tjLXHpeTHLYVnD9vZsMdFOWk8aAiBUvXCvoDx5gavhUDJmj91ktrYtpejoS8bok3Ow3HKrdJOMCxVDm7Ec80E9TAxc94me136bpQKA6bQNAaUup9jCj0uNrXDNug5inpbkaLy1IA0mGu5Wo3sg9eF6LXzG7fhi5uJuM6ooUNZ7JnEbhzmYzvSVyrPR7UAfI48XrZ763oLE8hbK0xjcGokO2qMUcBEmYZdOTcU7qkEDny7kyUz4gRKkvrFQynUNebi9Q5tXs95Bg4GJILDQiYozC7A9zYZWqZcw33p7kXeT8Ifr1CJwYoXdnak2PobUgXgngH7Wra5I0BmkhOcKrkkh57FG4AuCuE6My0ahmZHXhIQJXrcT5KuLnabwrb0suKftqSg5Opc8XNdT9roHgvg1cAEFb2vatHY1AyULvzTZ8qfIZRlHERtLA959UWG572TnN1FdZ5lnvzS6hv04DwYdLhCSE1epiqTWpJ5fQspvmqC1Xo17

http://www.safecanadapro.info/v298?product_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&filesize=82.95 MB&product_title=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&installer_file_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&product_file_name=MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar&product_download_url=http://www.ziddu.com/store/temp2/temp1/temp3/2010-3-25/D//1269527939_MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar

http://downloads.ziddu.com/downloadfiles/.../MyEgy.CoM.P.S.7.By.G_ME.ON.part2.rar

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove myegy.com.p.s.7.by.g_me.on.part2.rar.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.