» paint.net.exe
Overview
Analysis
File Details
Downloads (1)

paint.net.exe

Zeta Installer

LiveSoftAction SRL

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application paint.net.exe by LiveSoftAction SRL has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from www.download366.com.

File name:

paint.net.exe

Publisher:

LiveSoft Action (signed by LiveSoftAction SRL)

Product:

Zeta Installer

Version:

9.20.1.2

MD5:

c1d46640201a7718b30bb6d18b96d488

SHA-1:

8c5445ff744b1e84accf4790bef4b9f83792d317

SHA-256:

25d13825413de5af8be8b95dab92d7c8aef6e97f04252c6c20e7b8aabfddf198

Scanner detections:

18 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/25/2024 4:55:15 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.49

536

AVG

GetNow

2016.0.3014

Bitdefender

Gen:Variant.Adware.Jaiko.615

1.0.20.1150

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Agent-44271

0.98/20553

Comodo Security

Application.Win32.GetNow.DI

22113

Dr.Web

Adware.Iminent.25

9.0.1.0230

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.49

8.15.08.18.08

ESET NOD32

Win32/GetNow.I potentially unwanted application

9.7.0.302.0

F-Secure

Riskware.Gen:Variant.Application.Bundler

11.2015-18-08_3

G Data

Gen:Variant.Adware.Jaiko.615

15.8.25

herdProtect (fuzzy)

variant of acer v226wl user guide provided through pdfretriever.com.exe (Adware)

2015.10.3.22

MicroWorld eScan

Gen:Variant.Application.Bundler.49

16.0.0.690

Norman

Gen:Variant.Application.Bundler.49

11.20151003

Reason Heuristics

PUP.Sien.LiveSoftAction.Bundler (M)

15.8.18.8

Sophos

Live Soft Action

4.98

VIPRE Antivirus

Threat.4924203

40830

Zillya! Antivirus

Trojan.Black.Win32.34256

2.0.0.2213

File size:

1.1 MB (1,184,760 bytes)

Product version:

9.20.1.2

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SIEN SuperInstall

Language:

English (United States)

Common path:

C:\users\{user}\downloads\paint.net.exe

Digital Signature

Signed by:

LiveSoftAction SRL

Authority:

GlobalSign nv-sa

Valid from:

3/3/2015 5:24:08 PM

Valid to:

3/3/2016 5:24:08 PM

Subject:

CN=LiveSoftAction SRL, O=LiveSoftAction SRL, L=Bucuresti, C=RO

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112115C730891244FB88071FE814148E0E53

File PE Metadata

Compilation timestamp:

5/11/2015 3:33:58 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:rxB2qCTndgd24uu/wQmZptexrV2JAxNzpxgobHijZ8vLKxyeJyiO:rT2qCed24uomZbexcaxvxgozijsLK38

Entry address:

0x2DFCE0

Entry point:

60, BE, 00, 70, 5D, 00, 8D, BE, 00, A0, E2, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.9123

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

1 MB (1,085,440 bytes)

The file paint.net.exe has been seen being distributed by the following URL.

http://www.download366.com/paintnet/download/.../google

Remove paint.net.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.