home

advancedscantopdffree.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application advancedscantopdffree.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.factorycapitalstock.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
2037bb08f9124a6f301406ca9d9c8316

SHA-1:
de2db871884fa84ece04758b202cb07289d1ce95

SHA-256:
bc6c60fa718a959a773cbcbf99c2bb20799d98e1b7dfb2d10daff913d2dbf5ea

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 12:44:45 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.7.1.4

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\advancedscantopdffree.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 5:30:00 AM

Valid to:
3/25/2017 5:29:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Oti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:OEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9345

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file advancedscantopdffree.exe has been seen being distributed by the following 5 URLs.

http://www.factorycapitalstock.com/GsTE9MxTz3ZC hFJQt57Dc4NMiBQ9nrNCxPEGzKXIYrGMTq4847ecTmYxb9aOSHveLN9RL8yKZ2Hw09cZxOrefkTwovY0evRsd7GjBu12P47z4WJ70Zd7rqq5Ajs2mXJ7gyv_MUE5Po2 02EE701nz5CxB2IvHrwIdhByjk_JLe lkdwopr0eorooDsRtcj1CZe xI7lWGTtHkZvvpjNC5mul8UnfA==-G1wAAES3eX76PCH0BfJH2IIeDevIKTcP1GqlwQEvfAC5x9hZokgerzHDj9iGb_N0rw1_ceaq4CAhuQ hfKOAPq2IJNCrEj4A

http://www.factorycapitalstock.com/HEisPSd3BQO3z9Lwfc8sM64etG4aB9LbCzFTj3Fbr4SuIS_4U0JCpkktojI53tgtnO0P_Gy8BFVWWphpvqVDBlemFRJoDALX_j_GaUSq3LUEslWelV5v JML_K6QKin5NaMyKC71YS7Y3E7Yvn3DZes3hpRVrB685pCqscc4rJxz1SnlJjehcLObt1wmj7ffiXVeso_Y LPVboU6BItN HsNWrSIjA==-G1wAAES3eX76PCH0BfJH2IIeDevIKTcP1GqlwQEvfAC5x9hZokgerzHDj9iGb_N0rw1_ceaq4CAhuQ hfKOAPq2IJNCrEj4A

http://www.factorycapitalstock.com/3hw6QJkouhedHnL7hQziQFqnJsCP8jvohMJ42O2amA1H8tLiCTDTe5kSFhSCjlx7lxtW14NxUqeGbK0 3Ida5NfcETL8hr9kU_2JMBDu_071C9aRDCIDOM90suLiMeerXACTiqt7B0mt4M2CIqgJ8eS2Q68EK3cmjo Rwqe j5vYkZh7nhaShaPXx9vc34o5A3ZwkzKdEoTSIYn5YQLWXbFNaEqCrw==-G1wAAES3eX76PCH0BfJH2IIeDevIKTcP1GqlwQEvfAC5x9hZokgerzHDj9iGb_N0rw1_ceaq4CAhuQ hfKOAPq2IJNCrEj4A

http://www.funtourbundle.com/YeiJn7 J36GsMWhU4Ro0odIZTm6vIBaArdK7NAr0v6rUh5F19OW_0sNQogXDSHUv8A9bprJ l8XNpk3sLeSl1UWLjB1iMXgv_7yzhKQ6Pacdmhg02d_PH_vaTcia2prSuX2Om0l_IyusVM3CjOR7AjTT6g_0GfCfINgz2muaazy2cSo__G3nRcfz3xXMYTvzeiclxa9ItEFTIu5CCngciisNM9Jvtw==-G1wAAES3eX76PCH0BfJH2IIeDevIKTcP1GqlwQEvfAC5x9hZokgerzHDj9iGb_N0rw1_ceaq4CAhuQ hfKOAPq2IJNCrEj4A

http://www.taggiftflash.com/c?x=fDR0YWZZUsYR0ycuBHC4vr41pCx 1 BXJ60aSRe0tNQ=&c=P3LlPr//uGcycLdMT4O05Uqx2N89C2DPovKtnP6ucvd/z 0H6VdUQVSQsjb4pIlGHYYuUPdsOtvvSFAZdOtDKxJ/0kV6S34BEd7FVOHRU8aq4KvYlSkkzfijP7z6 WCXTLM2l4Qej72/ut63JSQXfPLR05a33fXHC4Rw9txfvek=&e=0&downloadAs=AdvancedScantoPDFFree.exe&fallback_url=http://www.downloadonic.com/scantopdfconverter.com/.../AdvancedScantoPDFFree_IS.exe

Remove advancedscantopdffree.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.