» popdeals4.exe
Overview
Analysis
File Details
Programs (2)
Network (1)

popdeals4.exe

Installmatic, LLC

This is part of the Installmatic installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file popdeals4.exe, “Windows MagnetDaily Application” by Installmatic has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the Installmatic Setup installer. Additionally, the file is typically installed by a number of programs including Windows MagnetDaily Application by Windows MagnetDaily Application and Windows GoodSales Application by PopDeals.

File name:

popdeals4.exe

Publisher:

MagnetDaily (signed by Installmatic, LLC)

Product:

MagnetDaily

Description:

Windows MagnetDaily Application

Version:

1.0.3.0

MD5:

a07a91bf5bbd894cfa5d745d4283e72a

SHA-1:

921d010f26cf7d5530e0a99cd38ce6b9d444800a

SHA-256:

48e58858f0fc2fef954c3c3e084e0a2dde500f771acf2b45ce0680eb17bab7b0

Scanner detections:

10 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

5/17/2024 5:22:27 AM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Adware.MSIL.Popdeals

4.0.3.15825

Bkav FE

W32.HfsAdware

1.3.0.7133

ESET NOD32

MSIL/Adware.Popdeals (variant)

9.12143

Fortinet FortiGate

Adware/Popdeals

8/25/2015

IKARUS anti.virus

AdWare.DealApp

t3scan.1.9.5.0

K7 AntiVirus

Adware

13.2016987

Malwarebytes

PUP.Optional.Installmatic.A

v2015.08.25.01

Qihoo 360 Security

HEUR/QVM03.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Installmatic.MagnetDaily (M)

15.8.25.13

Sophos

Generic PUA JC (PUA)

4.98

File size:

120.1 KB (122,944 bytes)

Product version:

1.0.3.0

Original file name:

popdeals4.exe

Bundler/Installer:

Installmatic Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\tmp1088.tmp

Digital Signature

Signed by:

Installmatic, LLC

Authority:

COMODO CA Limited

Valid from:

7/22/2015 9:00:00 PM

Valid to:

7/22/2016 8:59:59 PM

Subject:

CN="Installmatic, LLC", O="Installmatic, LLC", STREET="80 SW 8th St #2000", L=Miami, S=FL, PostalCode=33130, C=US

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

2D13291AEE51B2226F83396FCD33C1F1

File PE Metadata

Compilation timestamp:

8/20/2015 7:11:22 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

3072:gkJsCmj7+PIqrZ4zNZwsMouStNTmFNVU3bnm8:gWO+PjZ4zNZwsMoXtNTmFs3bf

Entry address:

0x1D7FE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

110.5 KB (113,152 bytes)

The file popdeals4.exe has been discovered within the following programs.

Windows GoodSales Application by PopDeals

About 3% of users remove it

Windows MagnetDaily Application by Windows MagnetDaily Application

About 5% of users remove it

The executing file has been seen to make the following network communication in live environments.

TCP:

Connects to sage.parklogic.com (69.39.236.56:8888)

Remove popdeals4.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.