» a-patch.exe
Overview
Analysis
File Details

a-patch.exe

installation manager

POPELER SYSTEM, S.L.

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application a-patch.exe by POPELER SYSTEM, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.

File name:

a-patch.exe

Publisher:

Firseria·SL (signed by POPELER SYSTEM, S.L.)

Product:

installation manager

Description:

installer_setup

Version:

3.1.14.4

MD5:

4f8abe3a6c87fa7256013ced317d5cfe

SHA-1:

53c7c826244b967ed184e752a004412d64ddc21b

SHA-256:

b966ecc54df7fd8c4a6553709463622c1e2665e05c2f4ed9a46a5245c40989d1

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/27/2024 12:56:02 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Solimba (M)

17.3.13.13

File size:

501.5 KB (513,528 bytes)

Product version:

3.1.18

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\a-patch.exe

Digital Signature

Signed by:

POPELER SYSTEM, S.L.

Authority:

Thawte, Inc.

Valid from:

8/28/2013 9:00:00 PM

Valid to:

8/29/2014 8:59:59 PM

Subject:

CN="POPELER SYSTEM, S.L.", OU=IT, O="POPELER SYSTEM, S.L.", L=Badalona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

58806C1A153885D4BFE2E3370340491F

File PE Metadata

Compilation timestamp:

7/17/2014 5:23:18 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

Entry address:

0xF58C

Entry point:

E8, 9A, 77, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, D8, F3, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 6C, F0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 64, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64... 
[+]

Code size:

118.5 KB (121,344 bytes)

Remove a-patch.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.