startdownload.exe

System Applet

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application startdownload.exe, “Fusion Install ” by System Applet has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.
Remove startdownload.exe - Powered by Reason Core Security
Publisher:
Fusion Install   (signed by System Applet)

Product:
Fusion Install

Description:
Fusion Install

Version:
2.4.8.1

MD5:
c30b590ca46f1c4c6cd32dd084061904

SHA-1:
3345a6908c5ff1ff6b3ae80ae726dfec53df60e9

SHA-256:
41733b24a84e6af3f4bacebbb774b46a438efc9f511a48c7b6d3ee0ee929d970

Scanner detections:
32 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/3/2016 12:51:15 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Agent
7.1.1

AhnLab V3 Security
14.06.10

Avira AntiVirus
APPL/OptInstal.opwb
7.11.152.50

Antiy Labs AVL
Trojan[:HEUR]/Win32.AGeneric
0.1.0.1

avast!
Win32:IBryte-DB [PUP]
2014.9-140610

AVG
Adware AdPlugin
2015.0.3448

CMC Antivirus
Packed.Win32.TDSS.2!O
1.1.0.977

Comodo Security
Application.Win32.iBryte.WRP
18308

Dr.Web
Trojan.Packed.26807
9.0.1.0161

ESET NOD32
Win32/AdWare.iBryte.AF application
8.7.0.302.0

F-Secure
Gen:Variant.Application.Bundler
11.2014-10-06_3

IKARUS anti.virus
PUA.InstallBundler
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.178.12257

K7 Gateway Antivirus
Unwanted-Program
13.178.12257

Kaspersky
not-a-virus:AdWare.Win32.iBryte
14.0.0.3733

Kingsoft AntiVirus
Win32.Troj.Generic.a.(kcloud)
331020.49267

Malwarebytes
v2014.06.10.10

McAfee
Generic-FAIN!9C941A3E0AA7
5600.7104

McAfee Web Gateway
GenericATG-FGI!746F50AE6DB0
7.7104

NANO AntiVirus
Trojan.Win32.Zusy.cyhpmk
0.28.0.59921

Panda Antivirus
14.06.10.10

Qihoo 360 Security
Malware.QVM10.Gen
1.0.0.1015

Reason Heuristics
Threat.Win.Reputation.IMP
14.6.10.10

Rising Antivirus
PE:Malware.iBryte!6.197B
23.00.65.14608

Vba32 AntiVirus
3.12.26.0

VIPRE Antivirus
Threat.4150696
29418

Zillya! Antivirus
Adware.iBryte.Win32.854
2.0.0.1790

Remove startdownload.exe - Powered by Reason Core Security
File size:
221.9 KB (227,192 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) 2013 Fusion Install

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\startdownload.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
3/24/2014 1:00:00 AM

Valid to:
3/25/2015 12:59:59 AM

Subject:
CN=System Applet, O=System Applet, STREET="4600 Madison Ave, 10th FL", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
18FCD6B5EEB5AEC66D0222B5CA1850D9

File PE Metadata
Compilation timestamp:
6/9/2014 3:00:10 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:HPFHRDi5UXDcoVwOfE7cmSMoMpzJiZON1P8LQjzDG5NMwwwwwwwgpvj:dHRDiQLWOfVMWB4OMwwwwwwwgpvj

Entry address:
0xF4B7

Entry point:
E8, 30, 53, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 44, 82, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 38, 80, 42, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63...
 
[+]

Code size:
154.5 KB (158,208 bytes)

Remove startdownload.exe - Powered by Reason Core Security