wie_2.10.8.3.exe

Insta-Download.com

The application wie_2.10.8.3.exe by Insta-Download.com has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.wajam-download.com.
Publisher:
Insta-Download.com  (signed and verified)

MD5:
7b4c7411e1e1ca5acbf27138e9e6cd85

SHA-1:
8a740dc35caed9b49effcc577a815f00ade958c0

SHA-256:
ae5118fae9d1bd90cec4e28f7c27b044221f742b1e257de7319043eab08b7748

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/25/2018 12:36:48 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstaDownload.Installer (M)
16.1.12.4

File size:
2.3 MB (2,388,000 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\wie_2.10.8.3.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
4/30/2014 9:00:00 PM

Valid to:
5/1/2015 8:59:59 PM

Subject:
CN=Insta-Download.com, O=Insta-Download.com, STREET=4115 Boul Saint-Laurent, L=Montreal, S=Quebec, PostalCode=H2W 1Y7, C=CA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3550B6E62FF3C1E2E800330D7D28C55A

File PE Metadata
Compilation timestamp:
12/5/2009 8:53:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:hvCAP6oqYdV30YxyPyq4nApuECdI4WcyNuEcOQ1AD9BhLlB9:VCAs230YQPd4Apu33zSXB9

Entry address:
0x36A0

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file wie_2.10.8.3.exe has been seen being distributed by the following URL.

Remove wie_2.10.8.3.exe - Powered by Reason Core Security