» 60769.facebookchatdesktop.exe
Overview
Analysis
File Details
Downloads (3)
Network (35)

60769.facebookchatdesktop.exe

Beta Installer

LiveSoftAction

The program utilizes the Appscion Download and Install manager, an adware distribution bundler from SIEN SA. The setup program includes ad-supported toolbars and utilities. The application 60769.facebookchatdesktop.exe by LiveSoftAction has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.

File name:

Publisher:

Live Soft Action (signed by LiveSoftAction)

Product:

Beta Installer

Version:

9.15.4.1

MD5:

c7fd9b955adf3cd7c3beabf18af58c42

SHA-1:

a8516e73ae80f56d94c350862d49018884bbf880

SHA-256:

a7780e0f8cbea825bb2dbd092e4402bd8c5923bd1fa1ba86990dccac349c3e48

Scanner detections:

10 / 68

Status:

Adware

Explanation:

This is a modified installer that uses the Appscion to bundle adware.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

11/6/2024 5:28:09 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2016.0.3063

Bkav FE

W32.HfsAdware

1.3.0.6379

Dr.Web

Adware.Iminent.36

9.0.1.0181

K7 AntiVirus

Riskware

13.202.15652

McAfee

Artemis!C7FD9B955ADF

5600.6719

Panda Antivirus

PUP/Multitoolbar

15.06.30.09

Reason Heuristics

PUP.Sien.LiveSoftAction.Bundler (M)

15.6.30.5

Sophos

Live Soft Action

4.98

Trend Micro House Call

Suspicious_GEN.F47V0413

7.2.181

VIPRE Antivirus

Trojan.Win32.Generic

39522

File size:

1.1 MB (1,179,816 bytes)

Product version:

9.15.4.1

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SIEN SuperInstall

Language:

English (United States)

Common path:

C:\users\{user}\downloads\60769.facebookchatdesktop.exe

Digital Signature

Signed by:

LiveSoftAction

Authority:

COMODO CA Limited

Valid from:

12/9/2014 7:00:00 AM

Valid to:

12/10/2015 6:59:59 AM

Subject:

CN=LiveSoftAction, O=LiveSoftAction, STREET="64-66, Mezzanine", STREET=Dionisie Lupu Street, L=Bucharest, S=ROMANIA, PostalCode=010458, C=RO

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

0DB89F49425D87D205160442DA55CE38

File PE Metadata

Compilation timestamp:

4/9/2015 3:00:24 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:TZz9QbQP7gd5F/CWlkTq7rv0qBkCdU47B+JwbRh/GocXBpsx7yEu:9zCiWOu9x94+T/GokBpt

Entry address:

0x2DC650

Entry point:

60, BE, 00, 50, 5D, 00, 8D, BE, 00, C0, E2, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.9116

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

1 MB (1,081,344 bytes)

The file 60769.facebookchatdesktop.exe has been seen being distributed by the following 3 URLs.

http://gsf-cf.softonic.com/a85/16e/.../FacebookChatDesktop.exe

http://stapi.trustinstaller.com/api/.../setup.exe

http://downloadastro_files.s3.amazonaws.com/60769.FacebookChatDesktop.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to mx-ll-110.164.11-219.static.3bb.co.th (110.164.11.219:80)

TCP (HTTP):

Connects to host-213.158.175.73.tedata.net (213.158.175.73:80)

TCP (HTTP SSL):

Connects to mx-ll-110.164.10-39.static.3bb.co.th (110.164.10.39:443)

TCP (HTTP):

Connects to 119-46-207-145.static.asianet.co.th (119.46.207.145:80)

TCP (HTTP):

Connects to 119-46-207-129.static.asianet.co.th (119.46.207.129:80)

TCP (HTTP):

Connects to mx-ll-110.164.11-218.static.3bb.co.th (110.164.11.218:80)

TCP (HTTP SSL):

Connects to mx-ll-110.164.6-168.static.3bb.co.th (110.164.6.168:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.16-54.static.3bb.co.th (110.164.16.54:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.16-103.static.3bb.co.th (110.164.16.103:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.10-35.static.3bb.co.th (110.164.10.35:443)

TCP (HTTP):

Connects to a95-101-78-178.deploy.akamaitechnologies.com (95.101.78.178:80)

TCP (HTTP):

Connects to a23-211-135-10.deploy.static.akamaitechnologies.com (23.211.135.10:80)

TCP (HTTP):

Connects to 210-86-141-58.static.asianet.co.th (210.86.141.58:80)

TCP (HTTP):

Connects to 115-178-57-11.sbn.co.th (115.178.57.11:80)

TCP (HTTP):

Connects to unknown.interbgc.com (217.9.235.147:80)

TCP (HTTP):

Connects to static-host119-30-107-234.link.net.pk (119.30.107.234:80)

TCP (HTTP SSL):

Connects to mx-ll-110.164.6-172.static.3bb.co.th (110.164.6.172:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.16-99.static.3bb.co.th (110.164.16.99:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.16-119.static.3bb.co.th (110.164.16.119:443)

TCP (HTTP SSL):

Connects to mx-ll-110.164.10-98.static.3bb.co.th (110.164.10.98:443)

Remove 60769.facebookchatdesktop.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.