» roommate.e01.540p-pppp.mp4.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

roommate.e01.540p-pppp.mp4.exe

YL production

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application roommate.e01.540p-pppp.mp4.exe, “Installer for BrilliantInstaller” by YL production has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

BrilliantInstaller (signed by YL production)

Product:

BrilliantInstaller

Description:

Installer for BrilliantInstaller

Version:

2014.6.4.1630

MD5:

3ead62c66b667340bceea5926f582dd8

SHA-1:

270a89b05ee1fc4e2ce573918ab02f8d3bd8e115

SHA-256:

89697f59e638bf1b1ac41a56d0f1b48de93eb065440c7c6486c7e888fd1b6e55

Scanner detections:

31 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

5/7/2024 5:54:26 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11372550

909

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.08.10

Avira AntiVirus

TR/AntiFW.b.114

7.11.156.24

avast!

Win32:InstalleRex-BX [PUP]

2014.9-140809

AVG

Generic

2015.0.3387

Bitdefender

Trojan.Generic.11372550

1.0.20.1105

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Antifw

0.98/19265

Comodo Security

Application.Win32.InstalleRex.KG

18624

Dr.Web

Trojan.WebPick.2627

9.0.1.0221

Emsisoft Anti-Malware

Trojan.Generic.11372550

8.14.08.09.06

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

8.7.0.302.0

F-Secure

Trojan.Generic.11372550

11.2014-09-08_7

G Data

Win32.Application.InstalleRex

14.8.24

herdProtect (fuzzy)

variant of nba.2k14.crack.only-reloaded.exe (Adware)

2014.10.10.20

IKARUS anti.virus

PUA.Kosmov

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.180.12484

Kaspersky

Trojan.Win32.AntiFW

14.0.0.3431

Malwarebytes

PUP.Optional.InstalleRex

v2014.08.09.06

McAfee

PUP-FHQ

5600.7043

MicroWorld eScan

Trojan.Generic.11372550

15.0.0.663

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.0.60253

Panda Antivirus

PUP/TSUploader

14.08.09.06

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

8.14.14.00

Reason Heuristics

Adware.WebPick.Installer.X

14.8.9.17

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4150696

29708

Zillya! Antivirus

Trojan.AntiFW.Win32.253

2.0.0.1833

File size:

315 KB (322,584 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\roommate.e01.540p-pppp.mp4.exe

Digital Signature

Signed by:

YL production

Authority:

Unizeto Technologies S.A.

Valid from:

1/16/2014 10:19:26 AM

Valid to:

1/16/2015 10:19:26 AM

Subject:

E=Lebedev72@hotmail.com, CN="Open Source Developer, Yuri LEBEDEV", O=YL production, C=RU

Issuer:

CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:

284B7B8274AFC7E851A73B98B619311F

File PE Metadata

Compilation timestamp:

3/12/2013 12:21:45 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:Gr2bUzkuvcBYC47l2xib6HwzFyytCr88oDG1GI25i1snqq0Ow:Gr/kuveY3dGwUECr88oDG1GIS+bq0Ow

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9527

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file roommate.e01.540p-pppp.mp4.exe has been seen being distributed by the following URL.

http://getapplicationmy.info/.../?&q=Roommate.E01.540p-PPPP.mp4&product_name=Roommate.E01.540p-PPPP.mp4&installer_file_name=Roommate.E01.540p-PPPP.mp4&q=Roommate.E01.540p-PPPP.mp4&external_id=1402088924383624383&self_redirect=1

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove roommate.e01.540p-pppp.mp4.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.