TSULoader.exe

Roman Borlov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application TSULoader.exe, “Installer for MiniApp” by Roman Borlov has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
MiniApp  (signed by Roman Borlov)

Product:
MiniApp

Description:
Installer for MiniApp

Version:
2014.4.27.1945

MD5:
25ad89500fb7f1097d9da7ed3758297f

SHA-1:
79b47a2e404151bea718ed673d2f4a6fdf98cbed

SHA-256:
1310fb01858d8b1edd00af353db15f99ab6ea9b65b4b1ad5d51ee6d5be92aa74

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/20/2024 2:48:32 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Installer-AP [PUP]
2014.9-140427

Comodo Security
Application.Win32.InstalleRex.KG
18173

Dr.Web
Adware.Downware.2108
9.0.1.0117

ESET NOD32
Win32/InstalleRex
8.9728

Kaspersky
Trojan.Win32.AntiFW
14.0.0.3952

NANO AntiVirus
Riskware.Win32.InfoLeak.cvgqot
0.28.0.59492

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Reason Heuristics
Adware.WebPick.Installer.J
14.5.9.15

Rising Antivirus
PE:PUF.InstallRex!1.9E4C
23.00.65.14425

Vba32 AntiVirus
Downloader.AdLoad
3.12.26.0

File size:
316 KB (323,592 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2014 MiniApp

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\tsuloader.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
9/11/2013 8:00:00 PM

Valid to:
9/12/2014 7:59:59 PM

Subject:
CN=Roman Borlov, O=Roman Borlov, STREET=Matrosova 29, L=Kiev, S=Kiev, PostalCode=01103, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EE2DB135C28BC41B5A2BC88B49037488

File PE Metadata
Compilation timestamp:
3/12/2013 4:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:frFbUzkuvcBYC47l2xWFAS3r/n2KvN48uFPPDZyMg5:fr2kuveY3ZF31N4XxZjc

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9526

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file TSULoader.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove TSULoader.exe - Powered by Reason Core Security