» super.2010._.xvid-ncode.avi.exe
Overview
Analysis
File Details
Downloads (3)
Network (1)

super.2010._.xvid-ncode.avi.exe

Nadav Kashtan

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application super.2010._.xvid-ncode.avi.exe, “Installer for StarApp” by Nadav Kashtan has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.

File name:

Publisher:

StarApp (signed by Nadav Kashtan)

Product:

StarApp

Description:

Installer for StarApp

Version:

2013.7.31.1745

MD5:

a2ac58c44c0c8f3b93e28f66390668c5

SHA-1:

8071fbac3d6794891c3c84352cd9e56cf9ab7e80

SHA-256:

00b645fac00ab8618d083e4aa58d4fbfb555f5f40895747be7fa43f14d287a66

Scanner detections:

24 / 68

Status:

Adware

Explanation:

Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:

4/19/2024 1:36:37 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Adware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.TSULoader

2014.06.29

Avira AntiVirus

Adware/Agent.aeph.13

7.11.157.134

avast!

Win32:InstalleRex-AB [PUP]

140617-1

AVG

Skodna.Bundle

2015.0.3429

Bkav FE

HW32.CDB

1.3.0.4959

Comodo Security

Application.Win32.InstalleRex.KG

18701

Dr.Web

Adware.Downware.1166

9.0.1.05190

ESET NOD32

Win32/InstalleRex.J potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/InstalleRex

6/28/2014

G Data

Win32.Application.InstalleRex

14.6.24

IKARUS anti.virus

PUP.InstallRex

t3scan.1.6.1.0

Kaspersky

not-a-virus:AdWare.Win32.Agent

15.0.0.463

Malwarebytes

PUP.Optional.Installex

v2014.06.28.04

McAfee

PUP-FHQ

5600.7085

NANO AntiVirus

Riskware.Win32.InfoLeak.cwixyc

0.28.0.60475

Panda Antivirus

PUP/TSUploader

14.06.28.04

Qihoo 360 Security

Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Trojan.AntiFW.B5

6.14.14.00

Reason Heuristics

Adware.WebPick.Installer.X

14.8.8.0

Sophos

InstallRex

4.98

Vba32 AntiVirus

Downware.TSU

3.12.26.3

VIPRE Antivirus

Threat.4753027

29708

Zillya! Antivirus

Trojan.Agent.Win32.404011

2.0.0.1840

File size:

307.5 KB (314,896 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\super.2010._.xvid-ncode.avi.exe

Digital Signature

Signed by:

Nadav Kashtan

Authority:

COMODO CA Limited

Valid from:

11/5/2012 12:00:00 AM

Valid to:

11/5/2013 11:59:59 PM

Subject:

CN=Nadav Kashtan, O=Nadav Kashtan, STREET=Bizron 38, L=Tel Aviv, S=center, PostalCode=67894, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00F861471B38887DE98076AFF491B1B1B3

File PE Metadata

Compilation timestamp:

3/12/2013 8:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:1rETJ6Y0JQBkQRl7174NpNUM+UHs+jf33ajdaRJmjv6h2QKU6Dn:1rEl63yRl1uqM+gs+DHC0Oz6bKUGn

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9458

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file super.2010._.xvid-ncode.avi.exe has been seen being distributed by the following 3 URLs.

http://www.superappzncmyworld.info/v279/?product_name=Super.2010._.XViD-nCODE.avi&product_title=Super.2010._.XViD-nCODE.avi&installer_file_name=Super.2010._.XViD-nCODE.avi&product_file_name=Super.2010._.XViD-nCODE.avi&product_download_url=http://50.7.161.131/d/.../Super.2010._.XViD-nCODE.avi&uuid=

http://www.superappzncmyworld.info/v279?product_name=Super.2010._.XViD-nCODE.avi&product_title=Super.2010._.XViD-nCODE.avi&installer_file_name=Super.2010._.XViD-nCODE.avi&product_file_name=Super.2010._.XViD-nCODE.avi&product_download_url=http://50.7.161.131/d/.../Super.2010._.XViD-nCODE.avi

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove super.2010._.xvid-ncode.avi.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.