» natiruts sorri, sou rei.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

natiruts sorri, sou rei.exe

Roman Malinenko

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application natiruts sorri, sou rei.exe, “Installer for QuickSet” by Roman Malinenko has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

QuickSet (signed by Roman Malinenko)

Product:

QuickSet

Description:

Installer for QuickSet

Version:

2013.11.20.1837

MD5:

3a41889c6d787deb132bef63ef237227

SHA-1:

49150d4e47ed087dff1269f052366a1f7877c794

SHA-256:

3613d04abf774646671de3418641e850ca03d58ce174ca0432ccc8ad8b6dbdc9

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/29/2024 4:48:53 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11024556

852

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.10.06

Avira AntiVirus

Adware/InstallRex.P.4

7.11.176.180

avast!

Win32:InstalleRex-AP [PUP]

141003-0

Bitdefender

Trojan.Generic.11024556

1.0.20.1390

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Installerex-92

0.98/19479

Comodo Security

Application.Win32.InstalleRex.KG

19711

Dr.Web

Adware.Downware.1719

9.0.1.05190

Emsisoft Anti-Malware

Trojan.Generic.11024556

14.10.05

ESET NOD32

Win32/InstalleRex.L potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

10/5/2014

F-Secure

Trojan.Generic.11024556

11.2014-05-10_1

G Data

Trojan.Generic.11024556

14.10.24

K7 AntiVirus

Unwanted-Program

13.183.13584

Kaspersky

Trojan.Win32.AntiFW

15.0.0.494

Malwarebytes

PUP.Optional.InstalleRex

v2014.10.05.04

McAfee

PUP-FHQ

5600.6986

MicroWorld eScan

Trojan.Generic.11024556

15.0.0.834

NANO AntiVirus

Riskware.Win32.Downware.crcxkm

0.28.2.62440

nProtect

Trojan/W32.AntiFW.326416

14.10.05.01

Panda Antivirus

PUP/TSUploader

14.10.05.04

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

10.14.14.00

Reason Heuristics

Adware.WebPick.Installer.X

14.10.5.15

Rising Antivirus

PE:Malware.Adload!6.EF6

23.00.65.141003

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4753027

33624

Zillya! Antivirus

Downloader.Adload.Win32.16904

2.0.0.1944

File size:

318.8 KB (326,416 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Common path:

C:\users\{user}\downloads\natiruts sorri, sou rei.exe

Digital Signature

Signed by:

Roman Malinenko

Authority:

COMODO CA Limited

Valid from:

8/19/2013 12:00:00 AM

Valid to:

8/19/2014 11:59:59 PM

Subject:

CN=Roman Malinenko, O=Roman Malinenko, STREET=Esplanadna 17, L=Kyev, S=Kyev, PostalCode=01001, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

47E3645CFB0C3CB8130567C3E5223C1D

File PE Metadata

Compilation timestamp:

3/12/2013 7:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:0r449uEo2S1YnQmCX492DkwNP3qpYFU/ULKRKuz0jB4Ptagah2Q+g:0r4Qu6/eIo4QKguz0jKP0gah2Q7

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file natiruts sorri, sou rei.exe has been seen being distributed by the following URL.

http://zilliontoolkitusa.info/v691?product_name=Natiruts Sorri, Sou Rei&filesize=5.1MB&product_title=Video2MP3 Download Manager&installer_file_name=Natiruts Sorri, Sou Rei&product_file_name=Natiruts Sorri, Sou Rei.mp3&product_download_url=http://sza.video2mp3.net/files/f2e9f028ea99042d1091a3b7aac56b23/52a1193c/youtube/2013/10/10/14/v/.../Natiruts Sorri, Sou Rei.mp3

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove natiruts sorri, sou rei.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.