home

package_secureprotect_installer_multilang.exe

SearchProtect

Tuto4PC.com

This is the Eorezo installer which may include software offers for unwanted programs including toolbars. The application package_secureprotect_installer_multilang.exe, “SearchProtect Setup ” by Tuto4PC.com has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Eorezo Downloader installer. It is also typically executed from the user's temporary directory.
Publisher:
Software   (signed by Tuto4PC.com)

Product:
SearchProtect

Description:
SearchProtect Setup

MD5:
b0160f0e696107c8065abb61cba0726d

SHA-1:
96e40d615e265a1a44b52270090fc5b09703ce31

SHA-256:
59ffd55479436c9586e804423f51084b5a9784efbd20e029f03ff0f12294e19b

Scanner detections:
33 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 6:40:23 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Eorezo.BZ
6324531

AhnLab V3 Security
PUP/Win32.Eorezo
2014.11.09

Avira AntiVirus
ADWARE/EoRezo.Gen
7.11.189.158

avast!
Adware-ASG [PUP]
150319-1

AVG
Generic
2016.0.3156

Baidu Antivirus
Adware.Win32.EoRezo
4.0.3.15328

Bitdefender
Adware.Eorezo.BZ
1.0.20.435

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
20241

Dr.Web
Adware.Eorezo.414
9.0.1.05190

Emsisoft Anti-Malware
Adware.Eorezo.BZ
9.0.0.4799

ESET NOD32
Detection.Undefined
7.0.302.0

Fortinet FortiGate
Riskware/EoRezo
3/28/2015

F-Secure
Adware.Eorezo.BZ
5.13.68

G Data
Adware.Eorezo.BZ
15.3.24

herdProtect (fuzzy)
variant of package_cubepileshopperz_installer_multilang.exe (Adware)
2015.7.3.6

IKARUS anti.virus
PUA.EoRezo
t3scan.1.8.3.0

K7 AntiVirus
Adware
13.186.14174

Malwarebytes
PUP.Optional.Tuto4PC.A
v2015.03.28.04

McAfee
Artemis!DAD177C4C929
5600.6812

MicroWorld eScan
Adware.Eorezo.BZ
16.0.0.261

NANO AntiVirus
Riskware.Text.Text.dozbeo
0.30.8.659

Norman
Adware.Eorezo.BZ
11.20150328

nProtect
Adware.Eorezo.BZ
14.11.28.01

Panda Antivirus
PUP/Tuto4PC
15.07.03.06

Qihoo 360 Security
HEUR/QVM06.1.Malware.Gen
1.0.0.1015

Quick Heal
PUA.AdwareEorezo.DC8
3.15.14.00

Reason Heuristics
PUP.Bundler.Eorezo
15.3.28.17

Rising Antivirus
PE:AdWare.Win32.Eorezo.a!1075356178
23.00.65.15326

Sophos
Generic PUA OP
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-RemoteAdmin
9970

Trend Micro House Call
TROJ_GEN.R047B01KS14
7.2.87

VIPRE Antivirus
Tuto4PC
35278

File size:
470.9 KB (482,168 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Eorezo Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\package_secureprotect_installer_multilang.exe

Digital Signature
Signed by:
Tuto4PC.com

Authority:
GlobalSign nv-sa

Valid from:
10/27/2014 12:32:39 PM

Valid to:
12/7/2015 4:27:40 PM

Subject:
E=contact@tuto4pc.com, CN=Tuto4PC.com, O=Tuto4PC.com, L=Paris, S=Ile-de-France, C=FR

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11214E18677190942D49073E30C52D17C351

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:0QiGo0xP82FEILYxuWSu3+PW6z+MBTlPadSfXioRcpMXVJo:0Qi1gfKUPu3+JKMBTlP0QjcpMXVJo

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9353

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.