» swf-printer-pro-1-20-10552-fr-setup.exe
Overview
Analysis
File Details
Downloads (1)

swf-printer-pro-1-20-10552-fr-setup.exe

Media Ingea SL

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application swf-printer-pro-1-20-10552-fr-setup.exe by Media Ingea SL has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from dw2.fr.uptodown.com.

File name:

Publisher:

Media Ingea SL (signed and verified)

MD5:

7f0b993cfbe1cc9aeb1ce0a4f8af9f61

SHA-1:

0fc657662aa86429a90447d8449d6bd2301ab557

SHA-256:

22a1a9981e3c87259b09480cf3181bcaec55838b4682afadee8e11b1f1fb520c

Scanner detections:

26 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/18/2024 10:29:50 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Zusy.95797

753

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

W32/Ramnit.C

7.11.30.172

AVG

InstallC

2016.0.3231

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.15112

Bitdefender

Gen:Variant.Zusy.95797

1.0.20.60

Comodo Security

Application.Win32.InstallCore.BWAN

18562

Dr.Web

Trojan.Packed.24524

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Zusy.95797

8.15.01.12.04

ESET NOD32

Win32/Injected.F trojan

7.0.302.0

Fortinet FortiGate

Riskware/InstallCore_JE

1/12/2015

F-Prot

W32/A-dbe1ec51

v6.4.7.1.166

F-Secure

Gen:Variant.Zusy.95797

11.2015-12-01_2

G Data

Gen:Variant.Zusy.95797

15.1.24

K7 AntiVirus

Unwanted-Program

13.1712403

Malwarebytes

PUP.Optional.InstallCore.A

v2015.01.12.04

McAfee

Artemis!303462994283

5600.6887

MicroWorld eScan

Gen:Variant.Zusy.95797

16.0.0.36

NANO AntiVirus

Riskware.Win32.InstallCore.dcnboj

0.30.0.64448

Norman

Kryptik.CDMO

11.20150112

Reason Heuristics

PUP.Installer.MediaIngeaSL.d

15.1.12.15

Rising Antivirus

PE:Malware.XPACK-LNR/Heur!1.5594

23.00.65.15110

Sophos

PUA 'InstallCore ToDownload'

5.09

Trend Micro House Call

TROJ_GEN.F47V0329

7.2.12

Vba32 AntiVirus

Downware.InstallCore

3.12.26.0

VIPRE Antivirus

Threat.4150696

29708

File size:

667 KB (683,008 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Digital Signature

Signed by:

Media Ingea SL

Authority:

COMODO CA Limited

Valid from:

8/1/2013 2:00:00 AM

Valid to:

8/1/2016 1:59:59 AM

Subject:

CN=Media Ingea SL, O=Media Ingea SL, STREET="Pirandello 16, planta 2", L=Malaga, S=Malaga, PostalCode=29010, C=ES

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C034A59569FF794D7687FB8D40A50D76

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:tvppvF/vS00mTbFw9TjMLmGOnLtrDuyjwMdD85XUZqs:tvLvhvSLmTbFwjMS1tfqMiXUZqs

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file swf-printer-pro-1-20-10552-fr-setup.exe has been seen being distributed by the following URL.

http://dw2.fr.uptodown.com/dm/1398524132/.../swf-printer-pro-1-20-10552-fr-setup.exe

Remove swf-printer-pro-1-20-10552-fr-setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.