home

windows msdart erd commander mega collection pack 2013.exe

Lior Sela

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application windows msdart erd commander mega collection pack 2013.exe, “Installer for StarApp” by Lior Sela has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
StarApp  (signed by Lior Sela)

Product:
StarApp

Description:
Installer for StarApp

Version:
2013.6.13.1400

MD5:
6bb81b2a1f26cd1290bfebecd9388117

SHA-1:
c8b1c366dad46e8b7cb0521eddbfa12345817a66

SHA-256:
84bbf059e1d3bb20c36efea8ca4abe44da7698693862791e9459c73a88624ffb

Scanner detections:
33 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/25/2024 12:25:53 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.InstallRex.2
5656960

Agnitum Outpost
Trojan.PEF13C
7.1.1

AhnLab V3 Security
PUP/Win32.TSULoader
2015.04.22

Avira AntiVirus
TR/PEF13C.ql
3.6.1.96

avast!
Win32:Downloader-UZF [PUP]
2014.9-150421

AVG
Adware AdInstaller.P
2016.0.3132

Bitdefender
Gen:Variant.Application.Bundler.InstallRex.2
1.0.20.555

Bkav FE
W32.FamVT.AntiFWK.Trojan
1.3.0.4959

Comodo Security
Application.Win32.InstalleRex.KG
21850

Dr.Web
Adware.Downware.1166
9.0.1.0111

Emsisoft Anti-Malware
Adware.Generic.560646
8.15.04.21.05

ESET NOD32
Win32/InstalleRex.J potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/InstalleRex
4/21/2015

F-Prot
W32/InstallRex.B
4.6.5.141

F-Secure
Riskware.Gen:Variant.Application.Bundler
5.13.68

G Data
Gen:Variant.Application.Bundler.InstallRex
15.4.25

herdProtect (fuzzy)
variant of gy+rhsnj.exe.part (Adware)
2015.7.22.22

K7 AntiVirus
Unwanted-Program
13.203.15663

Kaspersky
not-a-virus:AdWare.Win32.Agent
15.0.0.543

Malwarebytes
PUP.Optional.Installex
v2015.04.21.06

McAfee
PUP-FHQ
5600.6788

MicroWorld eScan
Adware.Generic.560646
16.0.0.333

NANO AntiVirus
Riskware.Win32.Agent.crfilj
0.30.20.1219

Panda Antivirus
PUP/TSUploader
15.04.21.06

Qihoo 360 Security
Trojan.Generic
1.0.0.1015

Quick Heal
Trojan.AntiFW.B5
4.15.14.00

Reason Heuristics
Adware.WebPick.Installer
15.4.21.13

Rising Antivirus
PE:Trojan.DL.Win32.AntiFW.a!1075355932
23.00.65.15419

Sophos
InstallRex
4.98

SUPERAntiSpyware
PUP.InstallRex/Variant
9921

Vba32 AntiVirus
AdWare.Agent
3.12.26.3

VIPRE Antivirus
Threat.4753027
39354

Zillya! Antivirus
Trojan.PEF13C.Win32.159
2.0.0.2147

File size:
285.4 KB (292,256 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2012 StarApp

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\software\msdart-from-unknown-supplier\windows msdart erd commander mega collection pack 2013.exe

Digital Signature
Signed by:
Lior Sela

Authority:
COMODO CA Limited

Valid from:
1/21/2013 7:00:00 PM

Valid to:
1/22/2014 6:59:59 PM

Subject:
CN=Lior Sela, O=Lior Sela, STREET=Moshe Sharet 46, L=Beer Sheva, S=Beer Sheva, PostalCode=84786, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D39C56B89258E40E737B2AEDA8D3D3E5

File PE Metadata
Compilation timestamp:
3/12/2013 4:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:MrkG6Y0JQBkQRl7174NpNUM+UHs+l96AzqrbuMEdFx7507KAFG9StKWpT:MrkG63yRl1uqM+gs+i6ubuhdL2pGiKw

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9551

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file windows msdart erd commander mega collection pack 2013.exe has been seen being distributed by the following URL.

http://filesaredirecty.asia/.../?product_name=Windows MSDaRT ERD Commander Mega Collection Pack 2013&installer_file_name=Windows MSDaRT ERD Commander Mega Collection Pack 2013&r=154

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

TCP (HTTP):
Connects to c1.stylezip.info  (54.186.255.26:80)

 
http://c1.stylezip.info/?step_id=1&installer_id=20570562&publisher_id=057&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=61711686&external_id=0&session_id=123423372&hardware_id=143993934&installer_file_name=windows+msdart+erd+commander+mega+collection+pack+2013

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.