» samsung-pc-studio.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

samsung-pc-studio.exe

Stanislav Kabin

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application samsung-pc-studio.exe, “Installer for FreshApp installer” by Stanislav Kabin has been detected as adware by 37 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

FreshApp installer (signed by Stanislav Kabin)

Product:

FreshApp installer

Description:

Installer for FreshApp installer

Version:

2014.7.31.1602

MD5:

bcbd18e6ccf464bfe57bd5f0d43cf608

SHA-1:

84d7efb03a50a7ee81a9cb2d24bd009b9bde0dbb

SHA-256:

609928a1331705e2c6e22875920203e5cca46d6b37101f344850a9ba6075bfb8

Scanner detections:

37 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/19/2024 3:25:52 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Kazy.324119

791

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

14.09.24

Avira AntiVirus

Adware/MultiPlug.aoa

7.11.164.242

avast!

Win32:InstalleRex-CK [PUP]

2014.9-140924

AVG

Generic

2015.0.3342

Bitdefender

Gen:Variant.Kazy.324119

1.0.20.1700

Bkav FE

W32.FamVT.AntiFWK.Trojan

1.3.0.4959

Clam AntiVirus

Win.Trojan.Installerex-1

0.98/19086

Comodo Security

Application.Win32.InstalleRex.KG

19049

Dr.Web

Trojan.WebPick.2759

9.0.1.0267

Emsisoft Anti-Malware

Gen:Variant.Kazy.324119

8.14.12.06.02

ESET NOD32

Win32/InstalleRex.M potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

12/6/2014

F-Prot

W32/InstallRex.B.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Kazy.324119

11.2014-06-12_7

G Data

Win32.Application.InstalleRex

14.9.24

herdProtect (fuzzy)

variant of spyhunter 4.17.6.4336 full version with patch.exe (Adware)

2014.12.6.7

IKARUS anti.virus

PUA.InstallRex

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.176.11684

Kaspersky

Trojan.Win32.AntiFW

14.0.0.3203

Malwarebytes

PUP.Optional.InstalleRex

v2014.09.24.11

McAfee

PUP-FHQ!D6BB6F2CE8EA

5600.6998

MicroWorld eScan

Gen:Variant.Kazy.324119

15.0.0.1020

NANO AntiVirus

Riskware.Win32.InfoLeak.cvgqot

0.28.2.61148

nProtect

Adware/W32.Agent.311488

14.04.07.01

Panda Antivirus

PUP/TSUploader

14.09.24.11

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

9.14.14.00

Reason Heuristics

Adware.WebPick.Installer.R

14.9.24.10

Rising Antivirus

PE:PUF.InstallRex!1.9E4C

23.00.65.141204

Sophos

InstallRex

4.98

SUPERAntiSpyware

Adware.InstalleRex/Variant

10195

Total Defense

Win32/Tnega.RefOZd

37.0.11197

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4753027

31208

Zillya! Antivirus

Downloader.Adload.Win32.16843

2.0.0.1774

File size:

315.4 KB (322,920 bytes)

Product version:

1.0.0.3

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Common path:

C:\Documents and Settings\{user}\My documents\downloads\samsung-pc-studio.exe

Digital Signature

Signed by:

Stanislav Kabin

Authority:

Unizeto Technologies S.A.

Valid from:

6/23/2014 3:28:15 PM

Valid to:

6/23/2015 3:28:15 PM

Subject:

E=Stanislav.Kabin@hotmail.com, CN=Stanislav Kabin, O=Stanislav Kabin, C=RU

Issuer:

CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:

3469022839E88D596EA6FE14C990AF76

File PE Metadata

Compilation timestamp:

3/12/2013 12:51:45 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:XrvbUzkuvcBYC47l2x0vOppHKip3Hrcgrz/xHWS1JA:XrkkuveY3oXpHggf4S1e

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9536

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file samsung-pc-studio.exe has been seen being distributed by the following URL.

http://www.programas-gratis.net/.../samsung-pc-studio

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove samsung-pc-studio.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.