home

angry birds provided through ads med network cpa.exe

Theta Installer

LiveSoftAction SRL

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application angry birds provided through ads med network cpa.exe by LiveSoftAction SRL has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer.
Publisher:
LiveSoft Action  (signed by LiveSoftAction SRL)

Product:
Theta Installer

Version:
9.22.1.1

MD5:
85b296656de7f5adfe68df3cb7344752

SHA-1:
6ff858e0c2eea9974525428c0f508fbc896796a9

SHA-256:
1f1cc70dbc64b1ee7fdc9c646e263606660bad399c9f8f3c068f99db927a5d38

Scanner detections:
17 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 4:50:04 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Jaiko.615
5627563

AVG
GetNow
2016.0.3091

Bitdefender
Gen:Variant.Adware.Jaiko.615
1.0.20.765

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Agent-45535
0.98/20538

Comodo Security
Application.Win32.GetNow.DI
22314

Dr.Web
Adware.Iminent.25
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Jaiko.615
10.0.0.5366

ESET NOD32
Win32/GetNow.I potentially unwanted application
7.0.302.0

F-Secure
Gen:Variant.Adware.Jaiko
5.14.151

G Data
Gen:Variant.Adware.Jaiko.615
15.6.25

MicroWorld eScan
Gen:Variant.Adware.Jaiko.615
16.0.0.459

Norman
Gen:Variant.Adware.Jaiko.615
03.12.2014 13:20:04

Reason Heuristics
PUP.Sien.Bundler
15.6.2.6

Sophos
PUA 'Live Soft Action' (of type Adware)
5.14

VIPRE Antivirus
Threat.4924203
40552

Zillya! Antivirus
Trojan.Black.Win32.35635
2.0.0.2201

File size:
1.2 MB (1,242,600 bytes)

Product version:
9.22.1.1

Copyright:
(c) Live Soft Action. All rights reserved.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SIEN SuperInstall

Language:
English (United States)

Common path:
C:\users\{user}\downloads\angry birds provided through ads med network cpa.exe

Digital Signature
Signed by:
LiveSoftAction SRL

Authority:
GlobalSign nv-sa

Valid from:
3/3/2015 8:54:08 PM

Valid to:
3/3/2016 8:54:08 PM

Subject:
CN=LiveSoftAction SRL, O=LiveSoftAction SRL, L=Bucuresti, C=RO

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112115C730891244FB88071FE814148E0E53

File PE Metadata
Compilation timestamp:
5/25/2015 3:26:22 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:GDNOvwRI2Ud5GniNdjETQ0bLaFjfD59x3SZ/10OWTBGVsLJvsyi7:GDaN/DNdjEE3tPSH0LBGVsLdb

Entry address:
0x2F4D50

Entry point:
60, BE, 00, E0, 5D, 00, 8D, BE, 00, 30, E2, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.9112

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
1.1 MB (1,142,784 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-52-11-223-130.us-west-2.compute.amazonaws.com  (52.11.223.130:80)

TCP (HTTP):
Connects to a23-67-250-138.deploy.static.akamaitechnologies.com  (23.67.250.138:80)

TCP (HTTP):
Connects to a23-67-242-121.deploy.static.akamaitechnologies.com  (23.67.242.121:80)

TCP (HTTP):
Connects to a23-13-171-27.deploy.static.akamaitechnologies.com  (23.13.171.27:80)

TCP (HTTP):
Connects to a23-13-165-163.deploy.static.akamaitechnologies.com  (23.13.165.163:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.