polyboard-programas-gratis-net.exe

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The application polyboard-programas-gratis-net.exe, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.bundlecentralbulk.com and multiple other hosts.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
dbce243d488e38cfc345edc1e1ecaae8

SHA-1:
1586af4fb92f0b7940cdba6e590155969d0bbce9

SHA-256:
8715a43566c1800142b0f3ad7319351abe84daa6800237ca7e69cf2908e17315

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/28/2024 3:29:17 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.7.18

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\polyboard-programas-gratis-net.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:04:31 AM

Valid to:
10/30/2016 10:53:45 AM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+KSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:+reTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file polyboard-programas-gratis-net.exe has been seen being distributed by the following 42 URLs.

http://www.bundlecentralbulk.com/c?x=sqJ2LJcrcxSpewSfHxmLtaADDs3SqlcmEoTJXxV9CF4=&c=Ff wooNOHc6 4i53YJWLe9Zod2mP5O1NeRAV 3sf9m63pbh1TvEdIs5rlQTQASvWsvGI8ymzkrRnZIyDXZeUj4Kc UcWVfYgrHYhePWIR/mwNfWbc KNAqDevajOVcAeRZmNdK1bYHjCHoVBkUiGbmfxgNZonfelAN bG3eEOz0=&e=0&downloadAs=polyboard-programas-gratis-net.exe&fallback_url=http://.../Polyboard_5_14g.exe

http://www.sendtowersnew.com/c?x=Rw6K20IGLMEt18 C0 jyuQUCcbmsV6ZozUiCWss3GjA=&c=jyf0hz0FKg 5/t4LvHc3sfTjwg 28g 9PbrrmlgzRUrVDb go30hKmMoNH4sB77YCOmWlxt vOGsT5CMNCJN1DM3gWU9XArFrTQ51tCgi5CdPf9rMlQitRg8bh7Ydj/tyEvbzb7mABtmRcIRUO8ap3V1AbaeLKtZDew7Nf9IbNXYoHqZrg/5cpd8jwRYSdz4&e=0&downloadAs=polyboard-programas-gratis-net.exe&fallback_url=http://.../Polyboard_5_14g.exe

http://www.giftbulkstock.com/c?x=hYhHz4 xy4kUPMrdf3uJw 0QqWIyuAH1GKfkcQZppvA=&c=fF1ft4VMKwvz APucqHScyxudWfat2CmLHd9qMcitO53k3PNEG/ppH0U83rygvsyK5FOG6GHrcf QEJMD5c0KHUTQ6sXFYfMi9fFcK11Kl6sDWSDd4wN2Nn7zpSFEnoE4GgI7lmPSapVvbTkyFLdMeNnMK4EGVfyQ5yrRiMlOAg=&e=0&downloadAs=polyboard-programas-gratis-net.exe&fallback_url=http://.../Polyboard_5_14g.exe

http://www.bundlecentralbulk.com/WVl6OTRQWGM0UkVSdE1raDBOazhsTWtKaFVuZEhTMWMyTld0SGF6aGpSSEJ2SlRKR1IxWndNWGxPZUZSRGRWUlllRFZ6SlRORUptTTlSRkZFUXpsUk5TVXlSa05hZEd4NWMzY3pPRUVsTWtaSWRUaG9WazFvU1dsb1dXUnNXRFV4WkU5QlVWQlFObXB6ZEdwTE1HeHhhVFpMU2psRmNWRm9NR1pHYzNCMkpUSkNRa2g2Y1ZZeU16SXhSRlJFYm10SFF6WlhkV2hLUjJSWEpUSkdPQ1V5UmpoaldYTkdNVGcwVW1aV1R5VXlRbGgyV21WMGQwUlBUbGRKYTFwSFNuUklPVmxYV0c4eVdUTXlWRXhwV2tsR2R6aGtSMmw0UTNVMGVXUjNKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFhCdmJIbGliMkZ5WkMxd2NtOW5jbUZ0WVhNdFozSmhkR2x6TFc1bGRDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ptYVd4bGN5NWtiM2R1Ykc5aFpIQnliMmR5WVcxaGN5NWpiMjBsTWtaUWIyeDVZbTloY21SZk5WOHhOR2N1WlhobA==

Latest 30 of 42 download URLs

Remove polyboard-programas-gratis-net.exe - Powered by Reason Core Security