» royal.pains.s06e01.seriestvix.rmvb.exe
Overview
Analysis
File Details
Downloads (2)
Network (2)

royal.pains.s06e01.seriestvix.rmvb.exe

Daneil Jemoch

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application royal.pains.s06e01.seriestvix.rmvb.exe, “Installer for MountainApp” by Daneil Jemoch has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

MountainApp (signed by Daneil Jemoch)

Product:

MountainApp

Description:

Installer for MountainApp

Version:

2014.6.12.1603

MD5:

92e545a4fa34a88af1450b2e8e39cd3b

SHA-1:

3ceef8cd6fee0cfde189920367babbca98915c21

SHA-256:

964d90f143862cb1a6d679716cb9956f8a77e93da8afa52ccfc862d3c58e458d

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/24/2024 7:37:54 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.AntiFW

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.11.03

Avira AntiVirus

Adware/InstallRex.EL

7.11.182.198

avast!

Win32:InstalleRex-CD [PUP]

141025-0

AVG

BundleApp

2015.0.3302

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.6185

Comodo Security

Application.Win32.InstalleRex.KG

19972

Dr.Web

Trojan.WebPick.2452

9.0.1.05190

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.4161048

11/2/2014

F-Prot

W32/Trojan2.OENW

4.6.5.141

G Data

Win32.Application.InstalleRex

14.11.24

K7 AntiVirus

Unwanted-Program

13.185.13866

Kaspersky

Trojan.Win32.AntiFW

15.0.0.494

Malwarebytes

PUP.Optional.InstalleRex

v2014.11.02.01

McAfee

PUP-FHQ

5600.6958

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.6.62995

nProtect

Trojan/W32.AntiFW.323840

14.10.31.01

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

11.14.14.00

Reason Heuristics

Adware.WebPick.Installer.EE

14.11.2.13

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4150696

34232

Zillya! Antivirus

Trojan.AntiFW.Win32.315

2.0.0.1974

File size:

316.3 KB (323,840 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Common path:

C:\users\{user}\downloads\royal.pains.s06e01.seriestvix.rmvb.exe

Digital Signature

Signed by:

Daneil Jemoch

Authority:

COMODO CA Limited

Valid from:

9/2/2013 1:00:00 AM

Valid to:

9/3/2014 12:59:59 AM

Subject:

CN=Daneil Jemoch, O=Daneil Jemoch, STREET=Dubenskay 3, L=Kiev, S=Kiev, PostalCode=03056, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

49A39B9858F6FBAB7EFD6CE450878DDB

File PE Metadata

Compilation timestamp:

3/12/2013 8:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:Br5bUzkuvcBYC47l2xhXcDp5xikxyI3rqrupq0FNhAna9iydforDT:BrqkuveY3fxikxyI7qSpBAna4ydfET

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file royal.pains.s06e01.seriestvix.rmvb.exe has been seen being distributed by the following 2 URLs.

http://forallhomee.com/download/v1160?product_name=Royal.Pains.S06E01.SeriesTVix.rmvb&installer_file_name=Royal.Pains.S06E01.SeriesTVix.rmvb&product_file_name=Royal.Pains.S06E01.SeriesTVix.rmvb&product_download_url=http://fra-7m16-stor02.uploaded.net/dl/bce3de9c-9ac0-4d52-8b3d-abe7fc65a811&reffer=http://.../&layout_id=8&filesize=&for_html_installer=1&uuid=BjgTZ3KklWUVLyeZ4oz2HWdTJAuPrbPnNhmH2KGDWHHfwPPb906ocJYDIWn1Q4i3bBkQftetId0vQsWDtclMx5JUHCRbA1tv5m8X3W3E0WTfBVkFORqlTWoL09qzqgffjgHIOqhaQQMFiA3KNmlOLfRSvo6NfMaQRO8MfXgdA9yJ9Z5n7Bm9gkLAQIrygu5c7rFMCKXRTqTdDWqDceBH3DkFTGNxlmehtKkCwkJlionynqRD6OdRFWeLfkVbn9NL96sXxmGEJXwYZRjIbTZVJLiSfnHGmn1ApBoQ2paaVjzfvpYH9F5U2ADw1eaToV6VRABHLxI2XLUiutPyiwbFbOXL879NuPdtJUXv2LwZdrReQFmHwT5Mf9Uv5Pyu2Q9mfEmv0z58eFlWfiFxcinkhDBNO0qHwjqotJVxrdP72OPasJpwtKBSco4aO27LliSDZ03odvoemIsZscPjNYqAsaupp07SqT5un1q3nsZzsQRWGJFaZNWtaIOL3ZInM3gfE3HIKSTrJ2fXWNNRjXgQMoisKpILy9i4MNjQlakznnlPLIePoFfz0kOsorbcDVHQeVOILzIM6045I4EqiRZX5SOVVWCZ44NVfhyPIyS

http://forallhomee.com/v1160?product_name=Royal.Pains.S06E01.SeriesTVix.rmvb&installer_file_name=Royal.Pains.S06E01.SeriesTVix.rmvb&product_file_name=Royal.Pains.S06E01.SeriesTVix.rmvb&product_download_url=http://fra-7m16-stor02.uploaded.net/.../bce3de9c-9ac0-4d52-8b3d-abe7fc65a811

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

TCP (HTTP):

Connects to c1.stylezip.info (54.186.255.26:80)

http://c1.stylezip.info/?step_id=1&installer_id=12872940&publisher_id=287&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=38618820&external_id=0&session_id=77237640&hardware_id=90110580&installer_file_name=royal.pains.s06e01.seriestvix.rmvb

Remove royal.pains.s06e01.seriestvix.rmvb.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.