home

the single moms club.exe

Anton Melnikov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application the single moms club.exe, “Installer for TopApp software” by Anton Melnikov has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
TopApp software  (signed by Anton Melnikov)

Product:
TopApp software

Description:
Installer for TopApp software

Version:
2014.5.23.1127

MD5:
96098e2fd834f8184f7614b636588ebf

SHA-1:
0eb98d6df9bf8163f4207cbf16979ae0126fa45c

SHA-256:
e33f37f1c4b659a05004b4283056c281d57f0d0f2d0ca61caab44192116c8b42

Scanner detections:
33 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/25/2024 7:12:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11455891
6383567

Agnitum Outpost
Trojan.AntiFW
7.1.1

AhnLab V3 Security
PUP/Win32.TSULoader
2015.02.16

Avira AntiVirus
TR/AntiFW.b.109
7.11.210.118

avast!
Win32:InstalleRex-DT [PUP]
150203-1

AVG
Generic
2016.0.3197

Bitdefender
Trojan.Generic.11455891
1.0.20.235

Bkav FE
W32.FamVT.AntiFWK.Trojan
1.3.0.6379

Clam AntiVirus
Win.Trojan.Antifw-8
0.98/20066

Comodo Security
Application.Win32.InstalleRex.KG
21097

Dr.Web
Threat.Undefined
9.0.1.05190

Emsisoft Anti-Malware
Trojan.Generic.11455891
9.0.0.4799

ESET NOD32
Win32/InstalleRex.M potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Generic.AC.4161048
2/16/2015

F-Prot
W32/InstallRex.B
4.6.5.141

F-Secure
Trojan.Generic.11455891
5.13.68

G Data
Trojan.Generic.11455891
15.2.25

K7 AntiVirus
Unwanted-Program
13.194.14971

Kaspersky
Trojan.Win32.AntiFW
14.0.0.2479

Malwarebytes
PUP.Optional.InstalleRex
v2015.02.16.05

McAfee
Program.PUP-FHQ
16.8.708.2

MicroWorld eScan
Trojan.Generic.11455891
16.0.0.141

NANO AntiVirus
Riskware.Win32.InfoLeak.cvgqot
0.30.0.65070

Norman
Trojan.Generic.11455891
03.12.2014 13:20:04

nProtect
Trojan/W32.AntiFW.323736
15.02.13.01

Panda Antivirus
PUP/TSUploader
15.02.16.05

Quick Heal
Trojan.AntiFW.A5
2.15.14.00

Reason Heuristics
Adware.WebPick.Installer
15.2.16.5

Rising Antivirus
PE:Trojan.DL.Win32.AntiFW.a!1075355932
23.00.65.15214

Sophos
PUA 'InstallRex'
5.10

Vba32 AntiVirus
Downware.TSU
3.12.26.3

VIPRE Antivirus
Threat.4150696
36694

Zillya! Antivirus
Trojan.AntiFW.Win32.215
2.0.0.2068

File size:
316.1 KB (323,736 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2014 TopApp software

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\the single moms club.exe

Digital Signature
Signed by:
Anton Melnikov

Authority:
COMODO CA Limited

Valid from:
8/27/2013 2:00:00 AM

Valid to:
8/28/2014 1:59:59 AM

Subject:
CN=Anton Melnikov, O=Anton Melnikov, STREET=Borshagovskaya 117, L=Kiev, S=Kiev, PostalCode=03058, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
008EFE75FFE332B06C663189A317121232

File PE Metadata
Compilation timestamp:
3/12/2013 9:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:GrYbUzkuvcBYC47l2xLnvhueEZdkKQ3+7Oj7hTOVA1HWZV6:GrdkuveY3CvI5Zdkj6OEu1HSE

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9538

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

TCP (HTTP):
Connects to c1.stylezip.info  (54.186.255.26:80)

 
http://c1.stylezip.info/?step_id=1&installer_id=17759350&publisher_id=775&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=53278050&external_id=0&session_id=106556100&hardware_id=124315450&installer_file_name=the+single+moms+club

Remove the single moms club.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.