home

updateinstaller.exe

Artem Izmaylov

This is a setup and installation application. The file has been seen being downloaded from aimp.com.pl and multiple other hosts.
Publisher:
Artem Izmaylov  (signed and verified)

MD5:
a3c6b2bbde04239b87f53f19a9807ec4

SHA-1:
c93439798ab376e96c40ce04a9dfeff02784e19f

SHA-256:
4ad2c03e4b28e7f239c115895b287a8eb15ff1993deac8acb4d139171317bb25

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 7:11:36 AM UTC  (today)

File size:
7.2 MB (7,551,384 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\aimp3\updateinstaller.exe

Digital Signature
Signed by:
Artem Izmaylov

Authority:
StartCom Ltd.

Valid from:
11/6/2012 6:28:30 PM

Valid to:
11/8/2014 12:36:54 AM

Subject:
E=artem@aimp.ru, CN=Artem Izmaylov, L=Tula, S=Tula Oblast, C=RU, Description=N0TtN9z9A3cgEBOy

Issuer:
CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL

Serial number:
07ED

File PE Metadata
Compilation timestamp:
5/17/2012 12:46:35 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
196608:MiDJea+XuD59jgRx9H6/F3KBiCTWHPtgWoKK:M+1rDvAxAbCToOWtK

Entry address:
0x12C2F

Entry point:
55, 8B, EC, 6A, FF, 68, 78, 5C, 41, 00, 68, C0, 2D, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, A0, 41, 41, 00, 59, 83, 0D, 44, A9, 41, 00, FF, 83, 0D, 48, A9, 41, 00, FF, FF, 15, A4, 41, 41, 00, 8B, 0D, 3C, 89, 41, 00, 89, 08, FF, 15, A8, 41, 41, 00, 8B, 0D, 38, 89, 41, 00, 89, 08, A1, AC, 41, 41, 00, 8B, 00, A3, 40, A9, 41, 00, E8, 1D, 01, 00, 00, 39, 1D, 30, 87, 41, 00, 75, 0C, 68, B8, 2D, 41, 00, FF, 15, B0, 41...
 
[+]

Entropy:
7.9986

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
72.5 KB (74,240 bytes)

The file updateinstaller.exe has been discovered within the following program.

AIMP3  by AIMP DevTeam
AIMP is a free audio player for Windows. In version 3, AIMP got its own audio engine, and full support for ReplayGain was added. Also, the music library interface was revamped, with new transparency effects.
www.aimp.ru
1% remove it
 
Powered by Should I Remove It?

The file updateinstaller.exe has been seen being distributed by the following 12 URLs.

http://aimp.com.pl/index.php/.../download?func=download&id=458&chk=7c6b1e41cc6a97b56b09c755b41966c2&no_html=1

http://ftp-stahuj.centrum.cz/dl/eba68ec82b9de4581fa3b595df471e87/5247298a/stahuj/download/software/secured/a/aimp-classic/.../aimp_3.51.1288.exe

http://softslot.ru/70099a0/audio-sound/.../AIMP.exe

http://storage.dobreprogramy.pl/.../aimp_3.51.1288(dobreprogramy.pl).exe

http://www.aimp.com.pl/index.php/.../download?func=download&id=458&chk=b062d562460a323ac0f88cf22530ddc4&no_html=1

http://aimp.com.pl/index.php/.../download?func=download&id=458&chk=9f3dbb89453081bb50f10aab54c8eba0&no_html=1

http://files.programki.net/.../aimp_3.51.1288.exe

https://doc-0k-3s-docs.googleusercontent.com/docs/securesc/5t93gp6g0o2l1i3e3v1oe73inaj55ba6/m1phd0cctlrj3h1e4l4k978goq9hi1s0/1378231200000/17555498143708591464/.../0B0hkLvGZtoWUVmJaNjFHbjBaWFE?e=download&h=16653014193614665626&nonce=flttbu0stseom&user=03786362134172568698&hash=juokrkhof2abuoqmd2iddpd45j74p8oj

https://docs.google.com/nonceSigner?nonce=flttbu0stseom&continue=https://doc-0k-3s-docs.googleusercontent.com/docs/securesc/5t93gp6g0o2l1i3e3v1oe73inaj55ba6/m1phd0cctlrj3h1e4l4k978goq9hi1s0/1378231200000/17555498143708591464/.../0B0hkLvGZtoWUVmJaNjFHbjBaWFE?e=download&h=16653014193614665626&hash=8dgd1tqe0jhqli8ggorgdkm01l91n8jf

https://doc-0k-3s-docs.googleusercontent.com/docs/securesc/5t93gp6g0o2l1i3e3v1oe73inaj55ba6/m1phd0cctlrj3h1e4l4k978goq9hi1s0/1378231200000/17555498143708591464/.../0B0hkLvGZtoWUVmJaNjFHbjBaWFE?h=16653014193614665626&e=download

https://docs.google.com/uc?authuser=0&id=0B0hkLvGZtoWUVmJaNjFHbjBaWFE&export=download

https://docs.google.com/uc?id=0B0hkLvGZtoWUVmJaNjFHbjBaWFE&export=download

Scan updateinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.