home

12c777dd-eade-7673-8c5b-06f559b10979_1d1c61db129c7a4

Lonumates

Colifile SLU

The file 12c777dd-eade-7673-8c5b-06f559b10979_1d1c61db129c7a4, “Lonumates Setup ” by Colifile SLU has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.headbundlesfarm.com and multiple other hosts.
Publisher:
Tap   (signed by Colifile SLU)

Product:
Lonumates

Description:
Lonumates Setup

MD5:
8a2592116223bcda1131a94bbf40fb9b

SHA-1:
0ca5ee0a8ce362ec023b626eb53596a26e760580

SHA-256:
528f846be7c4b1795319974ac96b6d6d437bf2965fff3d523e9d3cd8641f5737

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 5:47:26 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.Colifile.Installer (M)
16.6.14.8

File size:
931.2 KB (953,544 bytes)

Product version:
3.7

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\ProgramData\microsoft\windows defender\scans\filesstash\12c777dd-eade-7673-8c5b-06f559b10979_1d1c61db129c7a4

Digital Signature
Signed by:
Colifile SLU

Authority:
Symantec Corporation

Valid from:
11/18/2015 6:00:00 PM

Valid to:
11/18/2016 5:59:59 PM

Subject:
CN=Colifile SLU, O=Colifile SLU, L=Guia de Isora, S=Santa Cruz de Tenerife, C=ES

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
1D8228BD3D6A0EADA24B1453F4593406

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OisJLqRZHmJzmZEgtQ8PRkSFyS2jXCskT435jg1aE3t:vaCuSZQb7U+5MV3t

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9364

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file 12c777dd-eade-7673-8c5b-06f559b10979_1d1c61db129c7a4 has been seen being distributed by the following 10 URLs.

http://www.headbundlesfarm.com/c?x=HAPzcG0AsnxyQqiFf pq/JcNSCvwkyLiFjlX O6KTk=&c=teD/rIFQPD6a/qF/0X8Hprmg5EtA2s/TWsHZCeJoefDQzlyWzW7Z/1mZtBRGp3UEISOPS 49BZVm8p3KlozWhKOP8 j1 ayTocMI3qp Nnri9Ou8Wbg0h9TxHHdHPpQ5&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=YPKlrVSLMqtoumC82VRvodKv6JnQZ3leBP1EESRvWEo=&c=zEx5ith1EVyIAhnEmzRgU5XrACQnq7tvJwVJuvoHbrXFSujFNLggmdQsbJoK5HAdSN HM0 4Tbcsjmz9FMXGe6mQNjm86sw38Ovxg/ADOaXh43YFLxoCP2byz/UAXjvK&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=VHio1zFNFriVA2UtuzaHMXZvB cV6tQCRBtnWIWeO58=&c=LbIeQ9ihG363xO1NkCOHfCBqqZ0ej/zUxiNi505CGGOco e072X4WnLWBsoWPlMApSuxCQoaBPo/p5pyp/pZ125gmJ8cwkWFTtUPLFdIyRZlWqilnrC8XpLvHx1JiQbT&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=76Nfne41lHa3QglaWvm6 woxYasJntMNk9g2S1AVY5Y=&c=dqCHaQAZeAjP2jWcijJcI3X Y7DVPDds/FA/Nh7H01EOrDaBvjnx8nhQ6ngJe5zJCPEqz4ID5ZDQZ0FUCBVkYmkQBj0MlK0TlEWISowL5hm/uPb8IxWq4Yxrk2bc1RW4&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=vjn60A JllFiUL5Z2H1HmrqoJLbAgUaRgDIwj/9Jsd0=&c=gUb9vdFzYf j7mf5Q76Kr1OMhcrRVENsYtp2UCgupEwORdOVwrXZAg 74WUgQDPLMUqOUSIoI8KfjTjNYNNdvuZGJZmdbslRxAz5ibalsUMJ cOk07BNikHYIDPRoifx&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=vdrP4G5f0ju8spGSJiTl6ze0MkawMjXrAPr3UjSrFMQ=&c=kgHGHxHY0IjoZ09Q1Q QPg/zx/RrdNnHpMBNxj3OAcDqcdOPLkwyuZ6sbyuZTkPW0srme6PAqpCY8o8Zs0XALmvwZTM4otrRGPPPpbwovgZC5Fp0O/f1Ek9F vaU6Pbo&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=7a3Z8aq8gjDBeSVdUuShrYcyBDZaWxp/rjr7uGAShos=&c=6GU0TBGgSrHNygDoX fLdJvFrNTp9eJTCRWkgN/DCLJUCfB/vmrYrD3EJHszFQPWC2YkuVU4wdc8wwbDWEsNyh7F MI eQt fx4g4FEvxPJ1Wp0KeKfDCcLhAPyuzk/3&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=7KrQiqyAoXDIm JuvL1wcAk8pLrUxDxf78G4gMNRBPs=&c=nKBqaCpmEUvYdx/WaqdLUp/T98f0yuLt59MteWlJRd0ExEaHJSQldSXnJUk6ucT30kPhrZBt2GT5f3elv/dzW5fysYvlfudgUL1O8xJkRdhKQ4lPKd/ZH16pxcYF2fiz&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=JSGCGr2lrtxvlkR4H WLKCgaHROamHQ0wT6vSFKThKg=&c=D gsDvO6ttcpXVb4JZ LNNeTeEyJbHMOLtjc4/Hj1TQWBLNldBCi6YMoeHZ91Tj6zE9RoFksHCQ5oOH8m308THnv DcGAA81iAxbLRmt2/4tDAWbLku9bY 01fRhdeFM&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

http://www.headbundlesfarm.com/c?x=OK9VI3exmJ8rNrp061kTMnZUDuyz5TlWovgXm4lI15g=&c=NiOuIK0bagU2tbqKpx/CACMdNcs4d1aSI/6GEStUgwBQp5F130kpIa4KD3vytADSODpLHld/dIhTuI9V44ofidOPB72amJCzwI NUm7dA7S 7p6Yi9IPIUWmd3wWbn6V&downloadAs=Z-ZipSetup.exe&fallback_url=http://.../Z-ZipSetup.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.