home

updatechecker.exe

QUICK IDEAS, S.L.

The application updatechecker.exe by QUICK IDEAS, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Nullsoft Install System installer. The file has been seen being downloaded from www.hostingcurrentfarm.com and multiple other hosts.
Publisher:
QUICK IDEAS, S.L.  (signed and verified)

MD5:
b69bc64090fc2a12b5ea79108912bb58

SHA-1:
e12deb45ec92b70161ad1f5c3c047c54ffa26070

SHA-256:
12f2c125c980062eabbb8fb245b641c4d8d0971f8db854ca85154bbc7825573f

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Analysis date:
4/26/2024 10:36:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Vittalia.QUICKIDEAS.Installer (M)
16.2.3.17

File size:
81.4 KB (83,352 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\updatechecker.exe

Digital Signature
Signed by:
QUICK IDEAS, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
11/19/2013 5:50:57 PM

Valid to:
11/19/2014 5:50:57 PM

Subject:
CN="QUICK IDEAS, S.L.", O="QUICK IDEAS, S.L.", L=Madrid, S=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27D76F50DDF2FF

File PE Metadata
Compilation timestamp:
1/5/2012 7:21:36 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
1536:tl1u4wYQzaWUqRNIk6MbklLsv1Q79wotCJJ4Romu/FtleeK6T:tlU4wBzaWRRu38YLsdQGlJJ45+leha

Entry address:
0x4131

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 43, 43, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 44, 43, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 44, 43, 00, 56, A3, F4, 27, 43, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8B, 3B, 00, 00, A3, 50, 28, 43, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, A9, B2, 40, 00, FF, 15, AC, 44, 43, 00, 83, EC, 14, C7, 44, 24, 04, AA, B2, 40, 00, C7...
 
[+]

Code size:
33.5 KB (34,304 bytes)

The file updatechecker.exe has been seen being distributed by the following 17 URLs.

http://www.hostingcurrentfarm.com/WVl6OTRQWGxwYjFKWFIwTWxNa0psU2xKWFRDVXlSaVV5UWpScFRUQnJaRVo2Y25KS2FYZFJVbGcyT0VONWRsRmpaMnhwY0VVbE0wUW1ZejFyUTFkcGJUTkZXaVV5Um01V1RTVXlRa1kyYW1kRVRtRjNKVEpHVFc5b1oyaEdlWFk0SlRKR2VWbG9URkVsTWtKTGFXUk1WRVJEYlhsdVFWVnhZVEp4YmtveWFVVm1kV1pHTkVOaWFuVTVibEpyVTFCNFZsWldlRU4yUlU0MVVHUlRhRkJVUWxwMk9DVXlSbkZ3Ym1wbFUyVnVXWE00Vm1OSVRrUlVNRTEyY1hrbE1rWktWVUpGV25Wd1lXdHdabFZSUkhkS1FVTjRTRkpwTnpOblRHWnZUVXRFUVNVelJDVXpSQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbkpsY3k1dWIySnBjM1JsZUM1amIyMGxNa1pqWVdOb1pTVXlSblZ3WTJnbE1rWnRiM1pwWlcxaGEyVnlKVEpHVlhCa1lYUmxRMmhsWTJ0bGNpNWxlR1U9

http://www.giftvaultnow.com/0rp5nCcLdbSCiRxFgcdY16lgbLVRFWr5yBotdY84DgPlzVz_lLVj3WY2dQKoPSHOSkn_UWcYw_pDQdxYU4 BO5l4kYHtTcpy WhagFu2skJrPtrGlTlWIhHWKg1sSBTvWq3HyM94naaVt95vdmT6E7FW1tlwpf7_sbL63dksPGZzHYsEwkTPzfwT7K5RWNhvGTVzbIRczldbmcsSdXPNTHCAUDSBJyMbGRQ0aSMo3oFd9MFiPad4GgMAm5lnpvlWhKSU7y rUVcwciePyOWMHiDKZkwHGR0s5aSzni0vYWRrTF9JAPI=-Gz4AAEQ3F5tryVCUwV9 mT8IDjlg74skwALA4AbsbDTyG1 x7dzY_Tg99A5 5YKXeBG8IOxalHEI

http://www.giftvaultnow.com/X0nHnoclLN_rSgX51c8E9uc8_iBgOY2CdvGOShgnjC06uf5ZKxKOgvtJv20bmfa4kurvBIJXVP6H6ik0t9rq1lTkKGvyJAFuKNi1yY ZJVvKUPrOs3KAEp3wtpEIpiDzlLk16f TvRhmN_ond rm9RgKYmjtQe8uo6dUqsQIl1okuecfpRXdjj 2AINaTkJ sv72Lx3zQ_lg5vuvAbstLZdaHBOLvLqrlnlP0NJOz Bd nNUVui3NSFOOk6poBTkb kOWnIjpm6bqYMOE6unxpU4zruEejFmCaYJDtqJzutBVC7 gH8=-Gz4AAEQ3F5tryVCUwV9 mT8IDjlg74skwALA4AbsbDTyG1 x7dzY_Tg99A5 5YKXeBG8IOxalHEI

http://www.hostingflashmeta.com/c?x=SBJTMrYQAut76Q2kJpiIfdgDyvdv1HWWssTXeUa3fR0=&c=Cll2Y5sO4EzYVLvEMFbooEBy6x6HrbFdRwAcPLz10fVxhxY0KEu7V1AwekOFQ1oGc3OZgfFaQQU2amGAAOa48z2ff/248VXXQIEQumQWx1noanZ0t6i21h/TKSHO1FQU y35PkLgxnjf9x1H0gJvnujODS8XBFRjbFk1U9rDO E=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.hostingflashmeta.com/c?x=B9zoT/woSG5h/p m/FuxLRoAZ3sT/VNxqZpzYi01sbM=&c=AzyjA1i7WDLEpaVnmhu XcNZTYFbIIEiJpbIWmKrZ20RO 4/TIPzO 6ehn XzpZH/PjyWkKSRswzksI1wkYJ9tyZp9SpVwR4 oc IchMbB2KGcF2XlSYo5TtBdJCwrpZkPWM/OvqA5KztMG3RNZxJuUygoYMVPghJry0RQUV64=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.gifthosttours.com/c?x=xRFcdBhgdw7Y8ZxwV3wu4dJun0quso8XxwRPPTgMfc8=&c=1cGALBHt4PNhk7lzDwh3cJtFToHg4uZ8y/bOxwjLHY0pccY Ql9J8uDQ/1BUmQZ2TFvRrjw4wJvs76PlBv2hFq90Lm3W2ZkKL5xUz1lWZpDIqnx23jw/cvtagV2BO93OkhmkmqGhCXB9fYi/kdwwZjfivDaSU4XpI2QNTXOSvjg=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.tourpresentapps.com/c?x=93ST 54DHbExfaqUakjKqaE7041jzcEc/iwhZ/KSnT0=&c=AjnqPqPIbpbwqacm3jncMNlizNft7mvagEqpbG8OEyYIhfZLvBya5tr9/n69TKARAAnY76hEOhbSKKv MmEuNQXJLq2SdlQoIX/DfSYifc NGejj/ jJMMEnMweoDnG3oRD91jHJwx0cVek5HlY6Ai6qB0LsClGf0/NdE2256Lc=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.guardappsconcepts.com/c?x=6i/QjNOc3ST4oXADYIDwTnYk5kDBHgHFz2e8koIEuqs=&c=6KdkCrGEVroG7pCrEurtQL6quSevx 4Ud9/NQThHS8U2igvaN9YkkCBBgo7asAoDrlK ieSF19/AQ4QF4UjgrX0yeuXwgyaGshDa9Qw2qAl4oiur9hV552gFNKsjCK4SxGKF7gWqHjIOsErc/XRNjBoyZdDjBhkkuoBRZbUFW3g=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.contentsignssoftware.com/c?x=0JSyFVQa/e53LXfxvJh/b62D6mqbCV LN47bxihHhyo=&c=Z3jFbnke4kjYKdAUi2pThnWwT91b3C/oHgSFoygkJd7oPkAR3KRPSXt9cMu32tEgDtL0niqYgC4DU /9euDirMXoCR/kWE/OMMnYnU3SMDRwP Qm aTBc GYCVovHbINkafiOe/hXWeeIeVOZZjH9EXKpaMJTZcS /PCVr 64uQ1PjlPrtEvMrCFkag03chC&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.contentsignssoftware.com/c?x=8kgb8BZqJVFQ2FoBtgKPLhuhkE47oszusXCmDE4pY6Y=&c=cJ4bbU7Gc4nbRWDI66cZcFhzg8js86pOxC9RDmGZjpPPz1vzFcV7B5f/XLqUrD6xuUVrl6wDv2AT3p9DVU5usgnCyQWjiFK0wxAL4pvm9aaajP/c4JX5GexkikaFOGBTMuOHp7/rjxTLWNTT5wnNQGjnDlGn6FgWxJblqT3fYxg=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.contentupdatepackage.com/c?x=4IQlT7M5c2fSfqHgWGl8HJ1hWk4/C82TfAAMdUKGXJE=&c=2Cnmv01Ne3AFfdG6x18NooDKNNUUD/RzBEBlFyZbC7I3P6mLeAvvwdavOS9aHjpYz6HfFREUFLRTOLfFb9k11vc/jYQGvu4veR4I50zWJqltsGMEoIRkbNje/QenMzbB3MNl0dNEiMihRGLsOfXViULnUPnRhJj6Tp1T0Wsr3wzhHluiyhYf3N5hlKETf22Z&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=RIN8xDHwKrckgiefPdxtdHq15p3Yrmtj/K1YcvExnkg=&c=dzvgQQO3XDsTUMMKybYeUfucs2Clyh9NgoLTdaE207rDUseVvFh/g/GEyrSXJb98/1V9dTrcEXtW2zqZXP/LNB44zlNt0H4Sy WMmRVfr9Efc6 gAhDAhe6fub9uwOc6i1yNV5H/jwlwEmqNmGVptRIbfkAhvX ccE YOriXQk=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlescontentchuckle.com/c?x=sAtypGG367kuek56V1EODjLfH9giv2PHs8N/0wEWUmA=&c=riYHpfEXwHH/ZikdfUAtLM6w/QstFXAD2LYm1ujLGgWdwEjAwtesKIAjj6SqiOfmdSc4jbyMin vEJ6 iT6tZ1T2GiKFnerczOnqS8CVWcxjR2t6 meltpS27j3 p4xnHD96tnHZPWAe9BVIo2jRLg8ivQdbq4n3L6xLtmtPzW0=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.factoryhostchuckle.com/c?x=F8Jj4EOYTC28uZY332HHaVWGZ8znF0Z3/ O9C3A8f M=&c=yk8KUp0Ie4HgUO3kB3unmkdXQCWMWnSRwGr4y/KtNqRQ kV/YfgiFh74gH4Jn7uphqxibQevlUvM90FO9bpMbE6VPFkDtV7YArtA0I1akLEmz00jSnrliXllQWBTO6jlFoDDBYQI7xM6hddJEWOIZBHcqYlv2mgvN1ZwuCxE8 c=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.farmsoftwarebulk.com/c?x= N1Tjn6VtM78z53lrupp8NuEZcc2myGYFy7x/LHRcis=&c=bs0GBqutybEMv9TlGvENxwvEQc76JlsaXC9NK9wtUXMoswE7i5jAKBh5X9/OU4U1 7g7BWx2n8MwmdlvaW1/HEcErC4zff1lZ1LpD0TV74IrV9ZBq RXjQ Hc5ZVylGj6sKRRDbnD0oLlCLtQmzRJDb6uHAUL3SL8wfJ31kxFB0=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.heartflashpresent.com/c?x=k0z3vpOSsLpuTFj9pvnKq/ODvOLjIH5erMfBQJCpbgw=&c=6ynbCjPk30Ss1P3lCE526381 5nadpEBhpNEW kjz1Q/6zuAQNPyfAvfh4UNZtNA/2qTaAbiURoYL9hAzcZQPjMYTWjly5NWYFZWLM931DdljoIBRd9e0r9OIat5iloq58cS9BzQm978fpoLSfwPFSzPXP3s3GfldBve2h9Ox2U=&e=0&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.grabfarmtown.com/WVl6OTRQVlpvYWtOV2IzUTFOV1ZQSlRKQ2VrRmFlR3RXTkZnbE1rSXlUbk5QZFZwbFQyUmlaMjEzZWtwVVVuWkhhVTEzSlRORUptTTlkelZLVDBaYVptaEdPVVV5Wms1NWNFbENWV1F3ZUNVeVJrMW5SMGwyU2pKeVdFbEVha0pQUjJObFUyaE9OWGxTYmtOS2FXRnBRek5TWm1abGVIaGphbEJYVkVoSE1XeHpiMGwzUW1sWE0zaHViRzVHSlRKQ0pUSkdRbmcwT1cwellXbDFOMmRDZFRJMldXZFdSbkV5YkZVbE0wUW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWnlaWE11Ym05aWFYTjBaWGd1WTI5dEpUSkdZMkZqYUdVbE1rWjFjR05vSlRKR2JXOTJhV1Z0WVd0bGNpVXlSbFZ3WkdGMFpVTm9aV05yWlhJdVpYaGw=

Remove updatechecker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.