home

adwcleaner installer.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application adwcleaner installer.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.todaysendsoftware.com and multiple other hosts.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
bd6dd1711d0b7bbbb49b1f86b6549d12

SHA-1:
0c5093058f676979af859d66386075c813627b58

SHA-256:
a347b149cb53c7491f451a87b03e23378ffc87fcd8353cf638c2ae9701d04ba3

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 5:03:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.15.8

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\adwcleaner installer.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:30:20 PM

Valid to:
6/1/2016 5:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:mQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:mQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file adwcleaner installer.exe has been seen being distributed by the following 7 URLs.

http://www.todaysendsoftware.com/c?x=a1VfeSCB3gFFTxRe/nfvQOF8KPtK8phRNDlTXVgfQD8=&c=O7cCggyYmy/Z bPFTiAPDNxEiOrioxF4ai0WKG1Fcr5UbDLLO9/7fSkZAf ZNHMrA4e9vj8/8xvQ62PiokAokT4aRS0JQ7lQwvJigzw7fGjcwjJoyrvZoXkEMtw 5YFO&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=0J9rGP7mC8hFtxFWIJ5N /VP97fNipqxr/ EvVuqr 4=&c=0KfCoEtfT65uupNMA1iX7RhZP 7pALwW1/X7p85i7yHoNNgkNyQELmRcgGKgJJVv9Mn9hO4Z/jW28pYwFCC05OozWqW60a6KFnKoowUjUJlmxixJxZhatpLfIHRERZy3&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=R XvjZR0mCJiDUAT3Ai0xufMr3gsDxGQRNI9A/5WkuA=&c=/vpY6lJgYFgHL8gLBHNcMOhTvNIDMLFFZE48UmADv92PQ8R7WPM/YB3O62nBKXhwX6clMFbOGtafoPfv8xXngmJcHmughcVSyru05HVS7fZHWBkE99oexICANQCWGJ5O&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=57SuWFMrK7CXM0t7obF31V/9QV/7h2YXWuiVqSuptbc=&c=UaFKxAy3ipv0QdEiyOdnrT9obhTrjDsTMEqJCXFUuYTVcLkuuvHafPfGIsxAjAJncaNzHKT4FBokky78BW63fa44wef0y/nDFlAh1ts5Cce7Zc9hNWAOZL keH mT GA&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=DIt1ukKxu9hSaOyXRXp9edkTUAWaTWR5Ch9MXBhrNJY=&c=krfbcljRyrCjAoDixogLGjewqw8rGiojEzf/pCUTJ3t8gKjt1/dS6ogPfwNnMmB16eUwQllcHPgG0eh9fDacMXi1nGMsPYPGysNxDIEQRVDwBbhJ71sWqKHUC55QcdfD&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=eox3GAT7AGobqkIrE9bUj v10PVwepDUzBx7biAAShE=&c=NJm4d/JuMeYXraWMOzHFCzZ WJbXP/PMgdK1FR5SVsPk8yMGeYU05kv2MHfy/z6CpIR2N3 TVq3tTUW4vqS9MztZtQMF46PZSm L3DlW6S/tD1ujVpL5YlBfNbWddB63&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=kgBb6KZtDIUYbsr2E7ZudZOtFbQe H97XzGgcHO6gME=&c=gMkBhgtesmBEdEeOhT/ lSA5IjMfRWgjzDNHpialBA4Du2N70H 4ksvY9pyhoTDY3BF2n97V6P2DcEOd7i2rshLxZPSPDzhvvytK9wl3flQ5bqBlplIn3MPhfOLOzzci&downloadAs=AdwCleaner Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove adwcleaner installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.