home

2011.tmp

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The file 2011.tmp, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.sendtowersnew.com and multiple other hosts.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
afb70a7cd8755038f5646a324389b02f

SHA-1:
0f2aa6646b623679da041c7666038e5438ffa88e

SHA-256:
9b32b8a560a5ad236ab00dee9df81c15ce54075abd2d6364b600b09b39f87e69

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/15/2024 6:20:14 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.2.21.2

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\2011.tmp

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+KSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:+reTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 2011.tmp has been seen being distributed by the following 11 URLs.

http://www.sendtowersnew.com/c?x=osFWKkrUu8h/vY7VEGgCOysSdOSRYItwwfOBkwXxkOc=&c=cmYI M8lGxiEuQb60hPQJf9SSCXH6ll1meubdJJbkk145pZvHe1aH5Z63lmcQpyBipkAT4aYTJvDqWzqEmH6EH77gXJe1173CHNZpQO8/xsRVN2/GtrG2r7dZ1eOwi/o3eWWjWBTwBqrO9nhSolxLNglKuXDqc0Jra8fQz5rTTk=&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.bundlecentralbulk.com/c?x=w sFir4xKBiee hM JSw4opfI6PR2LgfNoxrRd669/Y=&c=tUDXIwbvge2iwdLkSqS1NLJG7MrOQ2Pe73k KUued1MMX9D66ewKv2g3hHxrSisvREpplaV YzRf2Hdp5uxLsyFaw72 G8CZWU8 1M0PPsjLE6pYTBX8pby6D1W3FFOqTZtzwbhEeCzAMxYF4iRoDKYGta3zNaQovibiU6UQRRs=&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.farmflashtour.com/c?x=nCUEjga/INOt8eU6/x H0Kja952lyWxtRSt3JMrnKT8=&c=Kfjpmb1s2UIusu2McfdaD/rSXpe1XTOMQSphrw0DTy/DNvDdDtRqc5kd4wADVK5w9q8xuddxVbdjN7s0A8SRY4RuDIFlEoR64GbmdUX2XYyGfpOjiRaO1tE0DsBUQkJWGaiSaLChgKBXhoAS0npi05k101K/kVni6ShWEAJQcVc=&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.bundlecentralbulk.com/WVl6OTRQVTltV0VWWk5HVnhNVm80U0VJd1VsVWxNa0pyVkRkQlZYcHlTbTV2UXpKeVl6SjBNMHROVG1FMVRYQjRUU1V6UkNaalBWZE5TeVV5UWxscFNrVm9aR0lsTWtaM2NrWjVjWEFsTWtJeVFUTlpjWEZ1VVhSVGIwdE9Sek5FYVZKTFZWUkpZblJ4UmsxWlIzUnVhbkZDU25jMGVrNUhNRVJOZUhsdWRYWTRXbkY1VmpkMlRHNVFOM0pSV25Wb2FsUTNNMkprTWpWNWVrMDBTbk5wTkdnM1oxaHhaemxNTUV4RFRWUnpaVW8yWTJsblMwMW9ha05pVVUxU1NrcGFlRlZGYUVONWRUaGlZVTAyVFVNMlRGTWxNa1ozSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBYaHdiR0Z1WlMxd2NtOW5jbUZ0WVhNdFozSmhkR2x6TFc1bGRDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1prWlhOallYSm5ZWE11Wkc5M2JteHZZV1J6Y0djdVkyOXRKVEpHZGpJbE1rWllMVkJzWVc1bFh6RXdYekF1WlhobA==

http://www.sendtowersnew.com/c?x=kunkq2RRVmaR3QuOGEZvkalxYUDYGQovNsgfTOgLLYU=&c=1fSD7kKoKy53WnXwGv5GNt0M3AVvR067srMDKYA8q0ISrbNY3cQdBMu RHYvMclV6uOBfOiEr4kS8bGEbHeBubofxO76ObywwtjAuEo6TGI/otyPLffU087Y96qcZpg6J 2MHLME5RXte8RpCNGMg9tNC7j1NSf/6Vlpofm2oppk7FnrWqohgqcu06rOJr8n&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.sendtowersnew.com/c?x=fiFoKX79fj3Q1Ft0Mk3jGN6Trb90oaLiNoFVG0 Uj18=&c=MVGCUxBBnXyEglODdCT6ddLuaDUX4QIBqs buRlk3hCQOeerBJBRqmOcN84eGJI0rUWEw9iZgNGG/ApKT2J0xSpHiA7qPjOoHOu 9FT72Y8Tue0gcqldrgktaJvbYSBv6fXArajR/oKb5kInlDQNnj7vYvEQaoSI5UDSCBGkXuL4AP1Ko9XEVzz3AFrn3Rw3&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.sendtowersnew.com/c?x=pfyo rFC9AolooN odKdUPG91HoxI0CBNgb98YvZRjA=&c=Ue8mVxsiigrY4siLoQVw5TvvmMFLPDuAdoMEtg5lJSLmYK44/flLvMJbFrBP4ckz3/uhFvIsHnHcUcQFDvPjGDLYggdZpZM22GgxpjR36neqGSC2cAZzsVTZrFo333rBG hLuwIFodxnzvczIE1Bq9ab0Ne509svvCtVzJPpoiA=&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.sendtowersnew.com/c?x=GkpUtPLkhxyEFrBBCFW2ZYizKo8J8kS2 5aZA30bEqY=&c=arbj0NlT52KggkCaPhDfKqL7KaCD6sJQaUvLX2xxK9dxtyizZaZx2ryNkZAILPBGAVD2SsFLg9Tr9xSGx1gIeTv7nfag/yKJXY5kHUxSS1XbtY5v6YVKA/rtg0 CZSa0KzwKVlJ68RuZhYAPGSS7mXLTbUDwwBp76QDwfdXmARI=&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.sendtowersnew.com/WVl6OTRQVVZpWkhRbE1rSkRkVVJqV2pZd05YZFpNM2RLYmtGYVExWXhNVFkwTUc5eFpVczNVbWxQWVcxWmJXMXZNQ1V6UkNaalBVaHNhR2R2VHpWS01XcGljVzVhTmpKTVZWaFlTVFl6TTA1QmRFOVBNaklsTWtKSmJUa2xNa0pSU2xkMlMwUlpVR0VsTWtaek1YQkRNa1JvY0hsdWJsbHBZMDVYWVZwQ0pUSkNaVFZNWnpKM1VWRjNaVkpOTVZVbE1rWTBWMVowVTBneFVuVjBVWGhUUlVsNVRFMTFNM1JEVXlVeVJuRnBTVmMwVUhrM01XaHZaMFZvYUU5TU9ERkNXRGR5ZEdsSFYzcHNRV2hMYjBkMVJIRTBTVGx4VURJbE1rWm5KVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFhod2JHRnVaUzF3Y205bmNtRnRZWE10WjNKaGRHbHpMVzVsZEM1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWmtaWE5qWVhKbllYTXVaRzkzYm14dllXUnpjR2N1WTI5dEpUSkdkaklsTWtaWUxWQnNZVzVsWHpFd1h6QXVaWGhs

http://www.sendtowersnew.com/c?x=/hpquV13j5NoXgUbK2fzvyBCTii04 DDdT3a3gH2ckQ=&c=a3fzktGgAqyA9Px6iFOLbIZNuZ 4kMVLfzatHr olU7eUYxbQL2q5RyCeTGNyCjnYFIZ6B1uMi5nWQCbGECaasO4C79pfI50IaybBgLfksw z9agzoi/I0fDoGEflz47&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

http://www.giftbulkstock.com/c?x=fQd6IYG7505gGBNn KqqQCUJPxSO NuFlMouMFVcbRc=&c=4hhnnzXLOLafQ4e849dugtnhjzNKXCCkCeykjAlhhzhsZZfs w1gACGXYLSMFZCS448NLy/IzuOZ2qsjGndzY6di AF0aFHyhK6LNTOUVz1DIeaVr7LfGMcf83yvaYRa6eb3dC0LVDYeK9YBA5twKlx2E65J5Qn8cja7BypR3k2D6v8L2FiylsZBaNqmSbBE&e=0&downloadAs=xplane-programas-gratis-net.exe&fallback_url=http://descargas.downloadspg.com/.../X-Plane_10_0.exe

Remove 2011.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.