home

antimalware-installer.exe

Activeris AntiMalware

Fiorentino Media Inc.

The application antimalware-installer.exe by Fiorentino Media has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from RevenueWire's affiliate distribution platform zty.fastagain.revenuewire.net and multiple other hosts.
Publisher:
Activeris   (signed by Fiorentino Media Inc.)

Product:
Activeris AntiMalware

Version:
Activeris AntiMalwar

MD5:
dac34d8f024eeec687ac435d151f24f4

SHA-1:
f04f3f855e1684fcf4e7e464fc7e5722819a984d

SHA-256:
51bc6547ce75153d27a6b4e6e8c4cc02b38326c5b7ff565938c39a0211d8a1a7

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 12:26:57 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Skodna.Generic_c
2015.0.3585

Comodo Security
ApplicUnwnt
17659

ESET NOD32
MSIL/AdvancedSystemProtector (variant)
7.9326

McAfee
Artemis!DAC34D8F024E
5600.7241

Reason Heuristics
PUP.Optional.FiorentinoMedia.V
14.2.22.22

File size:
4.6 MB (4,854,016 bytes)

Product version:
1.0.0.1

Copyright:
© Activeris

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\antimalware-installer.exe

Digital Signature
Signed by:
Fiorentino Media Inc.

Authority:
COMODO CA Limited

Valid from:
1/24/2012 6:00:00 PM

Valid to:
1/24/2013 5:59:59 PM

Subject:
CN=Fiorentino Media Inc., O=Fiorentino Media Inc., STREET=7904 E. Chaparral Road, STREET=STE A110-430, L=Scottsdale, S=AZ, PostalCode=85250, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009CB8D8E313806C1914ADA02E4DB86602

File PE Metadata
Compilation timestamp:
12/20/2011 8:16:50 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:4mZZBlOQbZCe2E1r9G02bCF/0sNGVY262W/X2eXwRQtbaAjP/zkx+a/5:lZZHOulzBAbCFcNaPNgkZP/Ax

Entry address:
0x16478

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01...
 
[+]

Entropy:
7.9912

Developed / compiled with:
Microsoft Visual C++

Code size:
84 KB (86,016 bytes)

The file antimalware-installer.exe has been seen being distributed by the following 50 URLs.

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?7m1024YEX9

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?Q310cq8zE7

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?lY10zXRBmo

http://pny11.fastagain.revenuewire.net/antimalware-v1/.../?var=SH&x=11&k=1&d=Virus&o=7?var=3

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?vh10idtgRf

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?f610p3nFHI

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?sY10hPib6G

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?UY10oVTge4

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?Wb10ceyswz

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?da10HbhokN

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?CK1035XcOb

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?aI10ruiwGB

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?Lf104CDaRU

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?nq10gbTBGZ

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?7J10p2czUt

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?UX10nH8wBy

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?n810ZgrkM2

http://gsf-cf.softonic.com/f04/f3f/.../file?SD_used=0&channel=WEB&fdh=no&id_file=69680047&instance=softonic_en&type=PROGRAM&Expires=1458560816&Signature=Egn3pDaCP9fE138WkZ7Z3ZkbqsfeF3~JJarcy~WTlVmEVW2nksUtSWAMjY75Er4c8myu6q3Lc7gvh5P2lbzgQJy80h-yiXRQ~VLSmb7BhONkAlrp5RG6QjLDGtLClT83sprdc2hnua4dl7e3AWMtZ9OfMT8xXeUVvVPMC-GzJiE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=AntiMalware-Installer.exe

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?sj10Qbgd8m

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?w510KvDyW7

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?yH10u6zMVI

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?Tw10XiYVE7

http://cdn.airdlr10.com/downloads/offers/.../AntiMalware-Installer.exe

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?Dc10ThxA48

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?eG10P7cyu5

http://zty.fastagain.safecart.com/antimalware-v1/.../?q510HeWKLs

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?q510HeWKLs

http://zty.fastagain.safecart.com/antimalware-v1/.../?wC10sivRxW

http://zty.fastagain.revenuewire.net/antimalware-v1/.../?wC10sivRxW

http://zty.fastagain.safecart.com/antimalware-v1/.../?H510MTUf6k

Latest 30 of 119 download URLs

Remove antimalware-installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.