» subtitles 1.3.exe
Overview
Analysis
File Details
Downloads (4)
Network (2)

subtitles 1.3.exe

Artur Kozak

The installer which is distributed via file sharing sites such as TusFiles uses the 'download manager' which wraps the original file in a adware filled bundle. The application subtitles 1.3.exe, “Installer for QuickSet” by Artur Kozak has been detected as adware by 30 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

subtitles 1.3.exe

Publisher:

QuickSet (signed by Artur Kozak)

Product:

QuickSet

Description:

Installer for QuickSet

Version:

2013.11.20.1837

MD5:

7b6053f358ca4907d28d2f7be847e472

SHA-1:

d38a620733f579f6b4b8b7d74b65aa54a9950947

SHA-256:

629e16f63033e5a84e97a1c9170df2cc010254c8ec133b5f63cded1632b63618

Scanner detections:

30 / 68

Status:

Adware

Explanation:

This bunder users the InstalleRex from WebPick Internet Holdings to install add-ons such as web browser extensions, coupon plugins (WebSave) and toolbars distributed via the tusfiles.net download site.

Analysis date:

4/25/2024 2:36:46 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

14.09.17

Avira AntiVirus

Adware/InstallRex.Q

7.11.143.174

avast!

Win32:InstalleRex-AH [PUP]

2014.9-140916

AVG

MalSign.Generic

2015.0.3349

Bkav FE

HW32.Paked

1.3.0.4959

Comodo Security

Application.Win32.InstalleRex.KG

18111

Dr.Web

Adware.Downware.1719

9.0.1.0259

ESET NOD32

Win32/InstalleRex

8.9681

Fortinet FortiGate

Riskware/InstalleRex

9/17/2014

F-Prot

W32/InstallRex.B

4.6.5.141

G Data

Win32.Application.InstalleRex

14.9.24

herdProtect (fuzzy)

variant of waves all plugins bundle v9r6-r2r.rar.exe (Adware)

2014.11.17.5

IKARUS anti.virus

Trojan.AntiFW

t3scan.1.7.8.0

K7 AntiVirus

Trojan

13.176.11770

Kaspersky

Trojan.Win32.AntiFW

14.0.0.3242

Malwarebytes

PUP.Optional.InstalleRex

v2014.09.17.02

McAfee

PUP-FHQ!89123D35C4DF

5600.7005

NANO AntiVirus

Riskware.Win32.Downware.crcxkg

0.28.0.59288

nProtect

Adware/W32.Agent.312232

14.04.15.01

Panda Antivirus

PUP/TSUploader

14.09.17.02

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.A5

9.14.14.00

Reason Heuristics

Adware.WebPick.Installer.M

14.9.16.7

Rising Antivirus

PE:PUF.InstallRex!1.9E4C

23.00.65.14915

Sophos

InstallRex

4.98

SUPERAntiSpyware

Adware.InstalleRex/Variant

10355

Vba32 AntiVirus

Downloader.AdLoad

3.12.26.0

VIPRE Antivirus

Installerex/WebPick

28256

Zillya! Antivirus

Downloader.Adload.Win32.16871

2.0.0.1925

File size:

304.7 KB (312,032 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Common path:

C:\users\{user}\downloads\subtitles 1.3.exe

Digital Signature

Signed by:

Artur Kozak

Authority:

COMODO CA Limited

Valid from:

8/22/2013 3:00:00 AM

Valid to:

8/23/2014 2:59:59 AM

Subject:

CN=Artur Kozak, O=Artur Kozak, STREET=Parkovaya 19, L=Kyiv, S=Kyiv, PostalCode=04078, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00E03731FB48F020DDF5953B6498B83BC6

File PE Metadata

Compilation timestamp:

3/12/2013 10:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:trkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiiz9:trkHu6/eIo4RXdrIO5/OpVHd6Ky6riz0

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file subtitles 1.3.exe has been seen being distributed by the following 4 URLs.

http://zilliontoolkitusa.info/.../?product_name=Subtitles 1.3&uuid=BZpptL6vg4WjAgIvC7G6RJZjvaO4o3JZZBU8X3E4P0Sw4M6hf3QKqKwlVDW9j5BuHLrBsPefgXJIvNpIeOqEy33onBfPSQDjBoJdfj168foI38rxZGHQIuWDFha28fJKyultMNYJNWe9EZxOPBPZ1Pn4BIsPJs80t5zXpgR6PNytJwphUaUhoReP4lD7WmU0tpULffqm2AMPQnqanacS3k1OgT2Ho7zs8tm5iGAlR6hZcs1KV4kTy0QPJssSPLNp1muSX1PFds4or0E8bYnuYx31nFWq2raxAbwOJVXmjs6aHjciQgmdd5W1VtNSwbcJImlR2OrnAtdKrbjZxiZQSppoqa00kZDNFKLwQ3dr3R41QKMzXjnvKqFwtpwINUueLdeSTQapbkAP3y4SQr61R3HytRL29NXIcvp758K7th4QPcM7G0Ln5weLRQOfLo1y6jT17haRVsSddoqTvyACMxEWJk2PLU2OLbAiINEskgNSLOEWa8HIW7WTru3YOGteoWNgo2pObERUckdJFrIb0hkhQqF12PDxGBpZcVfnYBQ1AkgmdobFsj14rBE0lgIWTZyZKW6rkSpCPj0xcoXJLYWfRWlkjDvNAY8gs7WWrJMSW6qCEphpqx8SLGdauifQ4qs8fEEG779FAC74Y66OfEwXsUH8Y3HEyGuba4dLZk98kOIUbWTIdHGCG3g9M3FFssVeRF6APq5qGEkJzZlEwAo6a7Ylw3JfbY0AnhPyTrPTqPxhQCWw7A5SPKDFQkCTf5HBuCj8VnMwdhlnE7GyHZ7BbWGCuo3SvU2rUM3lDXoL0utrj3u7CoiyrABzzJ9fFSdxQDkxagCsQ1njYyXKHhkyfV4DNrklrl1R8FxMsXK1nPJEveN0H1RNxWZT9aS5d3reGXBDFOXVipL4Z7m4Xf75P1YkR2JoAFS

http://zilliontoolkitusa.info/.../?product_name=Subtitles 1.3&uuid=52925a3de14b9

http://zilliontoolkitusa.info/v1495?product_name=Subtitles 1.3&uuid=52925a3de14b9

http://www.subtitles.com.br/download.php?software=Subtitles13

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to r1.getapplicationmy.info (54.201.215.30:80)

TCP (HTTP):

Connects to c1.getapplicationmy.info (54.201.215.30:80)

http://c1.getapplicationmy.info/?step_id=1&installer_id=10303839&publisher_id=028&source_id=0&page_id=0&affiliate_id=0&country_code=ES&locale=EN&browser_id=2&download_id=10903844&external_id=10333929

Remove subtitles 1.3.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.