» package_togglemark_installer_multilang.exe
Overview
Analysis
File Details

package_togglemark_installer_multilang.exe

ToggleMarkt

Tuto4PC.com

This is the Eorezo installer which may include software offers for unwanted programs including toolbars. The application package_togglemark_installer_multilang.exe, “ToggleMarkt Setup ” by Tuto4PC.com has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the Eorezo Downloader installer. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup.

File name:

Publisher:

Software (signed by Tuto4PC.com)

Product:

ToggleMarkt

Description:

ToggleMarkt Setup

MD5:

9a847f958975e1ca49aa123a06ebb5d7

SHA-1:

317d4ec40cdf8fdd70d2526d6c1b6267352ad971

SHA-256:

36a8d22a7c688a9cd7c0f62849efe55ca4b6bb376ab3f765ff0004898f847b0b

Scanner detections:

10 / 68

Status:

Adware

Explanation:

Uses the InstallMonetizer distribution platform to bundle adware.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/26/2024 4:49:11 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/EoRezo.Gen

7.11.163.164

avast!

Adware-ASG [PUP]

140813-1

AVG

Generic

2015.0.3363

Baidu Antivirus

Adware.Win32.InstallMonetizer

4.0.3.1492

Clam AntiVirus

Win.Adware.Eorezo-91

0.98/21411

Dr.Web

Adware.Downware.3239

9.0.1.05190

ESET NOD32

Win32/AdWare.EoRezo.AW application

7.0.302.0

Reason Heuristics

PUP.Installer.Tuto4PC.g

14.9.2.22

Sophos

EoRezo Adware

4.98

VIPRE Antivirus

Threat.4150696

29708

File size:

416.5 KB (426,488 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Eorezo Downloader (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\package_togglemark_installer_multilang.exe

Digital Signature

Signed by:

Tuto4PC.com

Authority:

GlobalSign nv-sa

Valid from:

11/5/2013 5:27:40 PM

Valid to:

11/6/2014 5:27:40 PM

Subject:

E=contact@tuto4pc.com, CN=Tuto4PC.com, O=Tuto4PC.com, L=Paris, S=Ile-De-France, C=FR

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121DD93F3AC652F954C795B593955887E31

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

6144:Z/QiQP+phOPpJSY5kKYgBpl7+hCnaTxUKsE9ceJRvcj68xhxXqo7V5/q/hAUfB:RQiG+IT7lKhC2Iqjzva6WXd55yGMB

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

Remove package_togglemark_installer_multilang.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.