vaudix.exe

Shlomy Golani

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application vaudix.exe, “Installer for SoftSafe” by Shlomy Golani has been detected as adware by 38 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
SoftSafe  (signed by Shlomy Golani)

Product:
SoftSafe

Description:
Installer for SoftSafe

Version:
2013.4.10.1655

MD5:
2e9fe81d4701bf86709037bf095df579

SHA-1:
11176f037d94aa21d810210df4594f3d0a824cd9

SHA-256:
a211391d1a76d7942bd338fd2d5ef0295a765dc4882db443dd3a31a3350d9e43

Scanner detections:
38 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
10/18/2018 8:49:21 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Generic.454134
530

Agnitum Outpost
Adware.Generic
7.1.1

AhnLab V3 Security
Adware/Win32.StartPage
2014.11.06

Avira AntiVirus
ADWARE/InstallRex.Gen
7.11.183.62

avast!
Win32:InstalleRex-Q [PUP]
2014.9-150823

AVG
Skodna.Pick
2016.0.3008

Bitdefender
Adware.Generic.424488
1.0.20.1175

Bkav FE
HW32.CDB
1.3.0.4959

Clam AntiVirus
Win.Adware.Agent-6667
0.98/19586

Comodo Security
Application.Win32.InstalleRex.KG
19997

Dr.Web
Adware.Downware.980
9.0.1.0235

Emsisoft Anti-Malware
Adware.Generic.454134
8.15.08.23.02

ESET NOD32
Win32/InstalleRex.I potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/InstalleRex
8/23/2015

F-Prot
W32/AdInstall.D.gen
v6.4.6.5.141

F-Secure
Adware.Generic.454134
11.2015-23-08_1

G Data
Adware.Generic.454134
15.8.24

herdProtect (fuzzy)
2015.10.20.10

IKARUS anti.virus
PUP.InstallRex
t3scan.1.6.1.0

K7 AntiVirus
Adware
13.176.11595

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.1537

Malwarebytes
PUP.Optional.InstalleRex
v2015.08.23.02

McAfee
Artemis!78647F3B6370
5600.6664

MicroWorld eScan
Adware.Generic.424488
16.0.0.705

NANO AntiVirus
Riskware.Win32.Agent.crfikt
0.28.0.58720

Norman
Trojan.Generic.9796733
11.20150823

nProtect
Trojan-Clicker/W32.Agent.290632
14.03.28.01

Panda Antivirus
PUP/TSUploader
15.08.23.02

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Quick Heal
Trojan.AntiFW.B5
8.15.14.00

Reason Heuristics
Adware.WebPick.Installer (M)
15.8.23.14

Rising Antivirus
PE:Malware.Agent!6.191
23.00.65.15821

Sophos
InstallRex
4.98

SUPERAntiSpyware
Adware.InstalleRex/Variant
9674

Trend Micro House Call
TROJ_GEN.R08NB01EE14
7.2.235

Vba32 AntiVirus
Downware.TSU
3.12.26.3

VIPRE Antivirus
Threat.4150696
34232

Zillya! Antivirus
Adware.InstallCloud.Win32.1
2.0.0.1976

File size:
282.2 KB (288,928 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2012 SoftSafe

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vaudix.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
6/6/2012 8:00:00 PM

Valid to:
6/7/2013 7:59:59 PM

Subject:
CN=Shlomy Golani, O=Shlomy Golani, STREET=Wingate 56, L=Beer Sheva, S=Israel, PostalCode=84428, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1E72B983ED68D3D614BCF3D7EEA59787

File PE Metadata
Compilation timestamp:
3/12/2013 4:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:9rkY6Y0JQBkQRl7174NpNUM+UHs+CRndGvHpIUV1uwi0fa3TXY2qX:9rkY63yRl1uqM+gs+K8HpIUPpi0f2RqX

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9553

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file vaudix.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

Remove vaudix.exe - Powered by Reason Core Security