home

soft32_java runtime environment_1.0.exe

Covus Freemium GmbH

The application soft32_java runtime environment_1.0.exe by Covus Freemium GmbH has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Covus installer. The installer is marketed through download protals and search ads as the free Oracle Java Runtime but will also install additional software offers which include adware, PUPs and browser toolbars. The file has been seen being downloaded from java-runtime-environment.de.xtremedownload.com a web site host known to distribute potentially unwanted software operated by WeDownload, Ltd.
Publisher:
Covus Freemium GmbH  (signed and verified)

MD5:
217c7a086b6a401f04f401869fab107c

SHA-1:
01daa3da251a4d8f15427e9bff7a4d0e4e916682

SHA-256:
6493f2bc2c6225b99012a668e79e2f49bbf801f218aee3222ec9452587c199be

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Includes bundled offers in the installer/download manager that include adware components such as Best-markit, and Search Protect (ClientConnect).

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/25/2024 4:00:13 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Covus.CovusFreemium.Bundler (M)
16.3.6.8

File size:
460.6 KB (471,624 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Covus

Language:
English (United States)

Common path:
C:\users\{user}\downloads\soft32_java runtime environment_1.0.exe

Digital Signature
Signed by:
Covus Freemium GmbH

Authority:
GlobalSign nv-sa

Valid from:
1/28/2013 10:21:57 AM

Valid to:
1/29/2015 10:21:57 AM

Subject:
CN=Covus Freemium GmbH, O=Covus Freemium GmbH, L=Berlin, S=Berlin, C=DE

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11211DBCB8A07ED407612FC406EFD259BE29

File PE Metadata
Compilation timestamp:
7/14/2014 3:26:17 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:wvWoBObcObcSkP+GtuVX1Hs7umWtC7uFBMD:U5IcI7s+JVFM7zt7uFs

Entry address:
0x1CA34

Entry point:
E8, A0, 48, 00, 00, E9, 89, FE, FF, FF, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 0C, DE, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF...
 
[+]

Code size:
171 KB (175,104 bytes)

The file soft32_java runtime environment_1.0.exe has been seen being distributed by the following URL.

http://java-runtime-environment.de.xtremedownload.com/get/file/id/.../?lp=adwords&tg=de&kw=Java runtime environment 7&mt=e&ad=44038940468&pl=&ds=s&gclid=CN3PsYGk1L8CFYfJtAodlCEApw&uid=14058727239e6955709b9b0a8d45d026c149981566&_ga=485694079.1390071357

Remove soft32_java runtime environment_1.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.