home

slide_powerpoint_dep_cho_thuyet_trinh_dsetup.exe

Slide PowerPoint dep cho thuyet trinh

Apps Installer S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application slide_powerpoint_dep_cho_thuyet_trinh_dsetup.exe, “Slide PowerPoint dep cho thuyet trinh installer” by Apps Installer S.L has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.
Publisher:
Apps Installer S.L.  (signed and verified)

Product:
Slide PowerPoint dep cho thuyet trinh

Description:
Slide PowerPoint dep cho thuyet trinh installer

Version:
1.0.5.0

MD5:
f22b29dbcb68b97481d2adda5d618d8f

SHA-1:
f8eba52c5c5888eaa70fdeb83c474af6a49293d2

SHA-256:
3fa26a6bf6aee0d14796c308dd9281f7f6f22bdb668591f0a6e0d6dfa0307b1d

Scanner detections:
12 / 68

Status:
Adware

Explanation:
This is a wrapped installation of legitimate software (without persmission of the developer) and bundles adware such as toolbars and extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 12:05:06 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Solimba.Gen
7.11.98.18

avast!
Win32:Solimba-C [PUP]
2014.9-131126

Boost by Reason
Adware.Installer.AppsInstallerSL.m
2013.8.24.1

Comodo Security
Application.Win32.Solimba.GW
16820

Dr.Web
Adware.Downware.1125
9.0.1.0330

ESET NOD32
MSIL/Solimba (variant)
7.8724

IKARUS anti.virus
Trojan-Dropper.Win32.Agent
t3scan.2.0.127

Malwarebytes
PUP.Optional.Solimba
v2013.11.26.02

Reason Heuristics
PUP.Installer.AppsInstallerSL.m
14.8.7.18

Sophos
DownloadMR
4.91

Trend Micro House Call
TROJ_GEN.F47V0514
7.2.330

VIPRE Antivirus
DownloadMR
20856

File size:
428.2 KB (438,456 bytes)

Copyright:
AppInstaller 2013 (132350422)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\slide_powerpoint_dep_cho_thuyet_trinh_dsetup.exe

Digital Signature
Signed by:
Apps Installer S.L.

Authority:
Thawte, Inc.

Valid from:
2/18/2013 4:00:00 PM

Valid to:
2/19/2015 3:59:59 PM

Subject:
CN=Apps Installer S.L., O=Apps Installer S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
323F44D66AEF890F43C32CFD743A4AD0

File PE Metadata
Compilation timestamp:
2/19/2012 7:01:49 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
6144:9saocyLCiPT5m31VAxkMTQgw3WRHwWVQGm9Ek45WWuQ3UoGB:9tobldCv2Tr5wWVQR9x4k7AUoM

Entry address:
0x4327

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 93, 42, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 94, 42, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 94, 42, 00, 56, A3, 40, 7B, 42, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 7B, 42, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, 94, 42, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.8785  (probably packed)

Code size:
34.5 KB (35,328 bytes)

The file slide_powerpoint_dep_cho_thuyet_trinh_dsetup.exe has been seen being distributed by the following URL.

http://dl.onesappz.com/g/1.0.5/.../slide_powerpoint_dep_cho_thuyet_trinh_dsetup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/37962/launch

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.