» wifi password hacker v3.1 mrfarhan.exe
Overview
Analysis
File Details
Downloads (1)
Network (1)

wifi password hacker v3.1 mrfarhan.exe

Roman Malinenko

This program bundles adware during the download and install process using the InstaleRex pay-per-install app monetizer. The application wifi password hacker v3.1 mrfarhan.exe, “Installer for QuickSet” by Roman Malinenko has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The file has been seen being downloaded from esyncsoft.info. While running, it connects to the Internet address r1.stylezip.info on port 80 using the HTTP protocol.

File name:

Publisher:

QuickSet (signed by Roman Malinenko)

Product:

QuickSet

Description:

Installer for QuickSet

Version:

2013.11.20.1837

MD5:

b02521624c33706fd567a15347312f9e

SHA-1:

8c166e89bc23fcf2df9f9636c4e07582b244cb45

SHA-256:

3ca00b28d98e719166aa21fd994c144007a64c542fe80609291338103a502b7d

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses Web-Pick's 'File Product', an Installer which wraps various products and downloads and installs it silently through the process, hosted on TusFiles.

Analysis date:

5/10/2024 12:52:52 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

Adware.WebPick.Installer (M)

15.12.29.7

File size:

305.1 KB (312,400 bytes)

Product version:

1.0.0.1

Original file name:

TSULoader.exe

File type:

Executable application (Win32 EXE)

Installer:

WebPick InstalleRex (Tarma)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\wifi password hacker v3.1 mrfarhan.exe

Digital Signature

Signed by:

Roman Malinenko

Authority:

COMODO CA Limited

Valid from:

8/18/2013 8:00:00 PM

Valid to:

8/19/2014 7:59:59 PM

Subject:

CN=Roman Malinenko, O=Roman Malinenko, STREET=Esplanadna 17, L=Kyev, S=Kyev, PostalCode=01001, C=UA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

47E3645CFB0C3CB8130567C3E5223C1D

File PE Metadata

Compilation timestamp:

3/12/2013 4:51:45 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:Srkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizl:SrkHu6/eIo4RXdrIO5/OpVHd6Ky6rizI

Entry address:

0x14DB

Entry point:

55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF... 
[+]

Entropy:

7.9570

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file wifi password hacker v3.1 mrfarhan.exe has been seen being distributed by the following URL.

http://esyncsoft.info/v377?product_name=WIFI Password Hacker v3.1 mrfarhan.zip&filesize=2.77 MB&product_title=DFH Download Manager&installer_file_name=WIFI Password Hacker v3.1 mrfarhan&product_file_name=WIFI Password Hacker v3.1 mrfarhan.zip&product_download_url=http://.../get.php?file=7115388b&m

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to r1.stylezip.info (54.186.255.26:80)

Remove wifi password hacker v3.1 mrfarhan.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.