home

7zip.exe

Tusoku

Platform Beta (Alpha Criteria Ltd)

The application 7zip.exe, “Tusoku Setup ” by Platform Beta (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.worldbodybyte.com and multiple other hosts.
Publisher:
Nanenede   (signed by Platform Beta (Alpha Criteria Ltd))

Product:
Tusoku

Description:
Tusoku Setup

MD5:
5b2c6271466a14d4d7f640b369fb218f

SHA-1:
7aef2ad8e82d427b78152b7485efe6c10e6963d6

SHA-256:
d8c55ece18b1c6c95430f55408f4c9bc1924435614077e82268a9493a6eefad9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/7/2025 9:38:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.28.11

File size:
943.6 KB (966,256 bytes)

Product version:
3.5.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\7zip.exe

Digital Signature
Signed by:
Platform Beta (Alpha Criteria Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:52:04 AM

Valid to:
7/27/2016 6:46:42 AM

Subject:
CN=Platform Beta (Alpha Criteria Ltd), O=Platform Beta (Alpha Criteria Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ECC46F7F85712126CA9617071FBF3734

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Lm0lfxxatWZQx03MimQy0pu2aWlFMhM4gmVF+:Lmg2WZq0cLQnpuYlihM4gmV0

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9394

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file 7zip.exe has been seen being distributed by the following 7 URLs.

http://www.worldbodybyte.com/c?x=XcImjYig01zV9OhjH7w0VklJIS1fr6LwWYnaCo37r04=&c=rX56MmhsqGQgOwOogJtoIg45HDRQ34ZjsKgaSzMacLGQPs1 1Y9AWx5FVxFQ0xVr5isrwR04Q4oa0BIePdeF6FU86i5sV27qBkwV3HU2RXHmjXA6oc4Lva47US72OoLX&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=KyIbP28K9n0WdC RDzPGaxZqs gcOYfL43Gf4ZQxwnY=&c=6zvvObWYLkl17T67/kfJ3Vh9e3J47 hd5Mzw/euBTo06wjb5apEYZUhmBWAdNbo/nsfES03xnLX97TZMGshS6tWgEHWqekHbcyF8lTtaL9NKut8TsAn2f0KeuogvxLZn&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=wlt8n0/ZCaY0b3j6xpdoWrLZqDBYqjj5RBacFEhId04=&c=SFblip3MiIlUwq31u5e0IE9UUI7m D3S7pk9CE3gM1VfO18DRUj7/QlSyfSVOzo 9X42jlNyVD1F20oqnc5kcCEQuvoNfRySg6WS40wo2rnEeKXFCyhHa5CnWx1G2 Zy&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=GKTH6nBkGqI 16WLnDrErEZWWmfg86QQJDZwjGy01V0=&c=mohQklLjk/WZBkJhimdEhfykw4DS9x6MTcGuuZ8T 39abjQsr8sAcE2pUffGa6crcsW2gSV6r5dwd yRwYR5yaICw8rATJNZrvu5rGl7UjUL1dE5g2laGWJYV YiKDpv&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=7dlvj/PAmP6I 5bCpSgrUPQvNxcn0PX3ySrnvvVGSVU=&c=d/WfS3DCBNUvTPrGea8E3sNJvKDQYHwqcwVVpWIZMFZLhNcOqhXVbzlMQ f9YtvteUgPMR1IDn4Ylcb8dPARPlkfW2OLMAJZ3yJNZdZFcE7V/5WfVMsGW33xnerrnik6&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=2hP57DE Y1trjdouB3Zpvcy4V8lsSCzP9F5bpq/5cB8=&c=nFKhQHpe3QEzuxnUzrOzxKwXLyIt4UJZmuqlfGRC4 nJY2uAxM/jDiYk871jqY MY6lhoCHX9whHFBzZGVYlTG/lR/9WDFQ0Ugdj0h ZozoTMxtVlITWrrc6vkX AnJI&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

http://www.worldbodybyte.com/c?x=8m1vQ8lSgCVNTqr2JoWkoO7Cad/O2XOkUFb6w1eDyaY=&c=bJ5XkmPginLx28vSzNn1Pm9S1WaQ8MST1wfRoaKOUU9T15RlwkOqku3bNOd34Xmt7nMhzt2drbZBJ1Smz9NY01NbC/1A3eVrubv/mu12Xc78w71xWPzaGBDShLjVQOFX&downloadAs=7zip.exe&fallback_url=http://www.filegoat.com/7zip/.../7z1514.exe

Remove 7zip.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.