» voicemask 4.0installer.exe
Overview
Analysis
File Details
Downloads (2)

voicemask 4.0installer.exe

Hus

SpeedySetup (Alpha Criteria Ltd.)

The application voicemask 4.0installer.exe, “Hus Setup ” by SpeedySetup (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.capitalheartlaboratory.com and multiple other hosts.

File name:

Publisher:

Dulorofehe (signed by SpeedySetup (Alpha Criteria Ltd.))

Product:

Hus

Description:

Hus Setup

MD5:

9540f6cb932adc8a9a984ca965b6a20f

SHA-1:

05fea5c46dfcbe46a4ddc7a4015b6a12de01a79f

SHA-256:

9d8e29854c57a1a949c4ce0c2aaf5a17386072d55b09ebfe7f37a102ae5b38c7

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

5/21/2024 8:17:30 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AC (M)

16.8.10.19

File size:

1 MB (1,050,576 bytes)

Product version:

5.3.7

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\voicemask 4.0installer.exe

Digital Signature

Signed by:

SpeedySetup (Alpha Criteria Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

1/6/2016 5:43:41 PM

Valid to:

8/20/2016 6:07:00 PM

Subject:

CN=SpeedySetup (Alpha Criteria Ltd.), O=SpeedySetup (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11216B7B9B1E7ABF6047433BDBCDE9234400

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:pUQrFgJ1EbCBVp7cLb7uveOJqLwl7OD/J//sk8VlXxPsmgl7uq:pLBNb2VFcLb7uvReBt//s1xRgT

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9074

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file voicemask 4.0installer.exe has been seen being distributed by the following 2 URLs.

http://www.capitalheartlaboratory.com/E9kjwrICo09WMEXIRpezY xuZQJN61DTUcdlrV6nE5FrsoVN9tdMFubTUU4g1Tybf _0uN9mieaCESt3KSda3nHBHZ9bV7QqqpuGsFGIzn0V8bKa9DM8MB6SAkSah9H J4gIUnqphGuRCZpuzQ_pcV4XikcO8tvhUmeunZ_GYLa7mePgpRymy0U9ja4cxjd cFgAGYpmICuLzY5isI3ZOR78VnmGA0a3vJT23pxqofA cbjwiBnSEaYvDg_zgH4epT6Qy_HKIgnL02Q6qqX8tew5KyUlMSCM9Cjv0V 0TeB92ebeItlirGj3C68HiVeFgLxQeIIsWUQoQ4DkrdPrvLqzHhr9ur9ilFmgsMgOv4sRASPnoFweiMpnU4fTxFtm2jyJzGlEpsggwWRzMMdIycGu_DGkPHYyexUCU w2PW5igTgArVY=-GxwAAMRtbD6du9GICATrlI5MIlBhGhKZnZ9wO_eELwE=-e

http://www.capitalheartlaboratory.com/zPjuRHiZYv6w2H6yCYa 7quiQ6oDKzk6ww5dHVFYlc9aw 6BsBHAlui6zhghousXqUC8GYplwc2keKVambZc2bfgz1w3WpPFnkLNFCSJu11CpKa9Rw7F1kkt5fzr9KBrV9pbFRMrr8gaoNyJov6NzeWk93R6gslY8 QjFBbswfX4_vCIGSMlo2Fsl7ESJ9953VEYnzc2zIz 3E8S4kGDmT ps2mpdfitL0mnnMomVFd0mIimYuznlJmVQlY0RPuy9uononICXL_qxcFbmq5vAKjHL9iXGs 5D htIWBnYDklvGJqIQJIjU4StNTpwNn00uUOjL7rCehAFywQtxYVc6BQlGLBNkZtJWMSEEQ8l9WxFA8EIQf2b3PIGu9vU EBDpxXDqjw8LzkAw7ElYP7W7jfgCfTwXvxgOaX_vwPTxEdYstLM g=-GxwAAMRtbD6du9GICATrlI5MIlBhGhKZnZ9wO_eELwE=-e

Remove voicemask 4.0installer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.