home

acrobat.exe

CPC NET ADVERTISING LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application acrobat.exe by CPC NET ADVERTISING has been detected as a potentially unwanted program by 10 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from acrobat.logiciel-france.com and multiple other hosts.
Publisher:
CPC NET ADVERTISING LLC  (signed and verified)

MD5:
21ebcc9ff3b1a11e6d9a1b1c506e1f9e

SHA-1:
eeb4b32027d61409e84c7f85aa6be5ff68129643

SHA-256:
b44b5f4ea90e69d2f8601002e4ae0b3726f64f4ff9ee4720bb6fe03102b05106

Scanner detections:
10 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 9:30:51 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod35b.Trojan
1.3.0.4613

Dr.Web
Adware.InstallCore.133
9.0.1.0329

ESET NOD32
Win32/InstallCore.CS (variant)
7.9165

Malwarebytes
PUP.Optional.InstallCore.A
v2013.11.25.07

McAfee
Artemis!21EBCC9FF3B1
5600.7270

Panda Antivirus
Trj/Dtcontx.H
13.11.25.07

Reason Heuristics
PUP.CPCNETADVERTISING.H
14.3.1.1

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.131211

Trend Micro House Call
TROJ_GEN.R0CBH05JE13
7.2.329

VIPRE Antivirus
InstallCore.b
24290

File size:
584.7 KB (598,704 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\acrobat.exe

Digital Signature
Signed by:
CPC NET ADVERTISING LLC

Authority:
Thawte, Inc.

Valid from:
11/27/2012 1:00:00 AM

Valid to:
11/28/2013 12:59:59 AM

Subject:
CN=CPC NET ADVERTISING LLC, O=CPC NET ADVERTISING LLC, L=NEW CASTLE, S=DELAWARE, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
6B567CAF2E519F1430E88B668E6CC8A1

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:wFyMJfsGqGnXJvweRvegInDm0ZPxYUZ/a0t9oSNyUnfrbXaAyuJA29917dYAHNlZ:qyMJfsn05Pvkm0ZPiU5aR3UnfrbTG29z

Entry address:
0x98CC

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The file acrobat.exe has been seen being distributed by the following 2 URLs.

http://acrobat.logiciel-france.com/download/.../acrobat.exe

http://acrobat.logiciel-france.com/fr.asp

Remove acrobat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.