home

pal_install_r1111.exe

Paltalk Messenger Setup

Paltalk.com

The application pal_install_r1111.exe by Paltalk.com has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This version of the installer will bundle the Ask.com Toolbar, a potentially unwanted web browser extension. The file has been seen being downloaded from www.capitalvaultsbits.com and multiple other hosts.
Publisher:
AVM Software Inc.  (signed by Paltalk.com)

Product:
Paltalk Messenger Setup

Version:
11,2,0,0

MD5:
7a52cd8a01278238b21caf70fdf7cdda

SHA-1:
adbea6addfcad06210da8ba92163d5d329193528

SHA-256:
0965ac846a1bd1654a35abbb55862e9f7183d020fdf37401301b13663dfc90bd

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Bundles that Ask.com toolbar as a third-party offer, a web browser extension that may modify a user's search and home pages.

Analysis date:
4/24/2024 4:17:35 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.1417
9.0.1.0358

ESET NOD32
Win32/Bundled.Toolbar.Ask (variant)
7.9190

Malwarebytes
PUP.Optional.Spigot.A
v2013.12.24.12

Trend Micro House Call
TROJ_GEN.F47V1113
7.2.358

File size:
14.6 MB (15,359,160 bytes)

Product version:
11,2,0,0

Copyright:
Copyright 1999 - 2013

Original file name:
paltalk_messenger_setup.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\pal_install_r1111.exe

Digital Signature
Signed by:
Paltalk.com

Authority:
COMODO CA Limited

Valid from:
5/10/2012 8:00:00 PM

Valid to:
5/11/2015 7:59:59 PM

Subject:
CN=Paltalk.com, O=Paltalk.com, STREET=PO Box 7528, STREET=Church Street Station, L=New York, S=NY, PostalCode=10008, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
729EE4CEB28A90BBF4B6792577437EE2

File PE Metadata
Compilation timestamp:
9/26/2011 9:21:28 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
196608:fZxpIv/d2NjhnU2Qt3qw4mKM5I+Ig3eMYIxPOhDlAH521zqDPznnFbcya6TvFo3n:fZxpW2H3wrj5BFED8GU1c7Uo3jmS

Entry address:
0x3883

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, 92, 40, 00, FF, 15, 84, 81, 40, 00, 68, 4C, 92, 40, 00, 68, C0, AD, 46, 00, E8, 18, 27, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Entropy:
7.9997

Packer / compiler:
Nullsoft install system v2.x

Code size:
27.5 KB (28,160 bytes)

The file pal_install_r1111.exe has been seen being distributed by the following 41 URLs.

http://www.capitalvaultsbits.com/BNu8GV1J14zRxBXy2gPVshbaXkBJCa2RbHQfYaN626XAHOJUMQjgPbUqOAJNWUzfvikD5wFAG_IJYanjAyHI_KvVWaM6zo8pBy5bKi zD8tXoRsFmB _nLBj4Iya_cXHllc_sw56cDM1b06 ufOL fASiYpuFFyHn0Ap59TNH4TQBj2nxCJCZvRDDtduHxVXFys9KxJMMXLRVhRHNI0G8Lef_BjJ w==-GysAAAR0Y7F9wZjkRUHw4JAD9m9PEgsIg42xcxUb caMH9gr VmTvrzinDIB

http://downloads.paltalk.com/download/.../pal_install_u39309836_a729_r109818_p128.exe

http://www.capitalvaultsbits.com/hLgQd0RcvkbDa 3yGho1wvU8EHJdloM2FFenYo2ef7cDibWt4jxmgAWp_S5bfnAhWvqaRCQNbHLt480XrHiRHEhXpn_Gf4byS6t9MiDdZ7zeEdhAyG3U9Wyr9ryRKVszpV7TRaKie0lOZx4Kv0RphMkfn_0CjEANfGTymbU0HOg4Dt4RA_DKy GcM wxr434pkfr37 H-GysAAAR0Y7F9wZjkRUHw4JAD9m9PEgsIg42xcxUb caMH9gr VmTvrzinDIB

http://download.paltalk.com/download/.../pal_install_u38421764_a729_r109812_p128.exe

http://download.paltalk.com/download/.../pal_install_u39030437_a729_r109736_p128.exe

http://download.paltalk.com/download/.../pal_install_u39097859_a729_r109812_p128.exe

http://www.capitalvaultsbits.com/Yc6_iE9_G3pFldXuW2FP0EcI_x7Y1P1 hH3UJpc9I4q4yo6wRS0OBfOp0y2148PRn6BBpFtgi3x2lA6Xv1Q8mpfhL5EmON1BvAgoUNoXBKSpVPDXw098JO_ZQR1U1Bb1Y_WR30ZjdaW7UGz3AsP1MHh8dnIYg2pQ7qDbQ9pbadKZ_mMyaPTXy33tpQDiZ MbS5erMfSb-GysAAAR0Y7F9GKO8KAgeHHLA_u1JYgFhsDF2rmIj35jxA3slP2vSl1ecUyY=

http://download.paltalk.com/download/.../pal_install_r109862_a3000.exe

http://download.paltalk.com/download/.../pal_install_r109812_a729_p128_u38032582.exe

http://downloads.paltalk.com/download/.../pal_install_u39211241_a729_r109812_p128.exe

http://download.paltalk.com/download/.../pal_install_u38501100_a729_r109812_p114.exe

http://downloads.paltalk.com/download/.../pal_install_r109862_a3000.exe

http://download.paltalk.com/download/.../pal_install_u39091039_a729_r109723_p128.exe

http://download.paltalk.com/download/.../pal_install_u38171723_a729_r109739_p114.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=US&sid=28f17f59e9e23989a7e6181e086b77d0&upv=537ca6756a6f9985b261cf811ca4edb6&z=results&sk=0&params=F39B2A32BFC101987B1458170C278E0390DBBE6D36AE3479EFDB6933EE8836391F7C9938B96B3D4265DA15F0652B27F722FCC26E7F9053E9BF9A1A85228C5A2B204206DFCAF9D41FE41F382C81A5FBCBA6EF8365247626CF778D7DC9655B28B3AAC62EBF2318ED7E804C711A4EAEB2C143694E978DFC7E2620BA276987AA6AA211D05C21EF61F501D863F237FC54466C79A236AA04E67CA26E3DB06C42D621EE&h=AEE9EDE610BA66BBC9994023F226FC8A276131B9D6774295DE1EED0BAE54B21B&directdownload=1&f=15549&d=http://download.paltalk.com/download/.../pal_install_a1103_r110015.exe

http://download.paltalk.com/download/.../pal_install_u39080656_a729_r109813_p114.exe

http://downloads.paltalk.com/download/.../pal_install_u39206354_a729_r109723_p159.exe

http://download.paltalk.com/download/.../pal_install_u38295658_a729_r109817_p114.exe

http://download.paltalk.com/download/.../pal_install_r110014.exe

http://downloads.paltalk.com/download/.../pal_install_r109860_a3000.exe

http://download.paltalk.com/download/.../pal_install_r132023.exe

http://t1.softonicads.com/tracker.php?ev=c&co=SA&sid=72296cc2ed28b16fd660a4d732b80265&upv=2c412c318ada8b640e3da16b7db58f08&z=results&sk=0&params=F39B2A32BFC101987B1458170C278E0390DBBE6D36AE3479EFDB6933EE8836399FDD4F323E8D1269F388483DB18B9E624A8D75B85DCD78DCD4DE0D21B794C30C0C5330E7E03D6DC171ACA622F0F5FEB21193A4738056FA14DE3D0EA8D905367B031F82B7305F7B96C6397F752A26036008728BEC4FF140244ABED3A9914B23779FE6DE77A359A60B5EF4D5A688EADCA24F563BC978DC1AA7A5F3C23E5C829F1D&h=81A0EB3EAA9CE42900CC7BBF8F8155B363D885E0FE3B73D43BF25FC1244BEC89&directdownload=1&f=15549&d=http://download.paltalk.com/download/.../pal_install_a1103_r110015.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=SA&sid=72296cc2ed28b16fd660a4d732b80265&upv=2c412c318ada8b640e3da16b7db58f08&z=results&sk=0&params=F39B2A32BFC101987B1458170C278E0390DBBE6D36AE3479EFDB6933EE8836399FDD4F323E8D1269F388483DB18B9E624A8D75B85DCD78DCD4DE0D21B794C30C0C5330E7E03D6DC171ACA622F0F5FEB21193A4738056FA14DE3D0EA8D905367B031F82B7305F7B96C6397F752A26036008728BEC4FF140244ABED3A9914B23779FE6DE77A359A60B5EF4D5A688EADCA24F563BC978DC1AA7A5F3C23E5C829F1D&h=81A0EB3EAA9CE42900CC7BBF8F8155B363D885E0FE3B73D43BF25FC1244BEC89&directdownload=1&f=15549&d=http://download.paltalk.com/download/.../pal_install_a1103_r110015.exe

http://downloads.paltalk.com/download/.../pal_install_r132023.exe

http://download.paltalk.com/download/.../pal_install_u37918587_a729_r109813_p114.exe

http://www.paltalk.com/download/.../pal_install_r17716.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=SA&sid=0dd1613efbd6ccd5ecf9d906b8c3d90e&upv=b15ea118a9484d7adaed56aed46c9081&z=results&sk=0&params=F39B2A32BFC101987B1458170C278E0390DBBE6D36AE3479EFDB6933EE8836399FDD4F323E8D1269F388483DB18B9E624A8D75B85DCD78DCD4DE0D21B794C30C0C5330E7E03D6DC171ACA622F0F5FEB2244AC27FE4AA42C5ACF32C454BA3B48ACD80BCC62FBF12F96197D4E0B0F6B48BB8E4DC8040055D0FC576C8AC6007D89E59C1ABB8EF749DE96C08E41800CACA1C5BE18ABE98824437E66CC1813CDEBC4B&h=3532F28FDB4D0A68E121D3599184C1CBBD86BC429F547EF2937C63D670B2B5E1&directdownload=1&f=15549&d=http://download.paltalk.com/download/.../pal_install_a1103_r110015.exe

http://download.paltalk.com/download/.../pal_install_u38428324_a729_r109818_p128.exe

http://www.paltalk.com/download/.../pal_install_r1420.exe

http://download.paltalk.com/download/.../pal_install_u37855114_a729_r109817_p114.exe

Latest 30 of 41 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to vip1.g5.cachefly.net  (66.225.197.197:80)

TCP (HTTP SSL):
Connects to ec2-54-235-141-218.compute-1.amazonaws.com  (54.235.141.218:443)

TCP (HTTP SSL):
Connects to ec2-174-129-28-15.compute-1.amazonaws.com  (174.129.28.15:443)

TCP (HTTP SSL):
Connects to ec2-107-22-244-144.compute-1.amazonaws.com  (107.22.244.144:443)

TCP (HTTP SSL):
Connects to ec2-54-225-247-31.compute-1.amazonaws.com  (54.225.247.31:443)

TCP (HTTP SSL):
Connects to ec2-54-225-144-96.compute-1.amazonaws.com  (54.225.144.96:443)

TCP (HTTP SSL):
Connects to ec2-54-225-103-192.compute-1.amazonaws.com  (54.225.103.192:443)

TCP (HTTP SSL):
Connects to ec2-50-19-82-219.compute-1.amazonaws.com  (50.19.82.219:443)

TCP (HTTP SSL):
Connects to ec2-23-23-88-231.compute-1.amazonaws.com  (23.23.88.231:443)

TCP (HTTP SSL):
Connects to ec2-23-23-245-1.compute-1.amazonaws.com  (23.23.245.1:443)

TCP (HTTP SSL):
Connects to ec2-23-23-100-107.compute-1.amazonaws.com  (23.23.100.107:443)

Remove pal_install_r1111.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.