home

audioconvertmergefree.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application audioconvertmergefree.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.funtourbundle.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
4de89710f98bfe0c18e0daf17da052f0

SHA-1:
639efc5a9ba87c28f5ed2bcbb9e093e7ff781f48

SHA-256:
55eeb1483e6a032b1441bdb5643b416adefb4af909c50e287d60245cc5603079

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/13/2025 3:53:41 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.17

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\audioconvertmergefree.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 6:00:00 PM

Valid to:
3/24/2017 5:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 4:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:hEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file audioconvertmergefree.exe has been seen being distributed by the following 8 URLs.

http://www.funtourbundle.com/ZRMRVN02EwFbBR6lVqmcqFC3UM_b8YMrf W7Q ZxRoZeIYwRYlBFp8nEitkVpN4HMcIac_NMW_cAl2Dn 4R5D FfI0qHd4ezaUcPOqvwx4oL3_JsFGyLJtWwFXd0c4KP2FGs_Rpv29oWtHggoHrR5aMg14NEZYCUn8_1jzLepIdVNXtfv_ypFg9XP3DdyKsqXCmhNlXPnJGP3CbKqDf81M8_Rb3T7w==-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=

http://www.taggiftflash.com/Ql2elrQyceknYC0WrxfdGr0UhBEmo0WkDosvYxLVU5skrjiNnbe7n7o6LK Xga1gCr6 jG4k9ok0lC9dM8w1kjVhdPirVV 68qKcSqECfAh1C XMtlUJFu gieZC IgRYmkNLm0aq d6ElznqDqeDpE5T9J noB6ME0m2M7qEasGsQjT RYYeYGN FFSazfi8M dexLt65rUM4kwSkj92GsjZc6eSQ==-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=

http://www.funtourbundle.com/crLFWroynJJHu k8ByNPgEIfxr4eXT4IJmPSFT2tMt8QnYhGmGsEUnep5LodFSN1AtFgcTOTZjjYcGHOHIPKzxHBE25glYiu1cg_gflDwH wR0JEag0kIRIGzepV7xHI6o7Yhd5J5rcZvqszWa8MZmnkuHTPFORf9XCfVIElez14LspZ1KlzO4xsoXp wojNSJjNtoOHL7iXTp0RiMOGTfoXptpejw==-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=

http://www.funtourbundle.com/YVooMinx2EZNgL5AXdsalKOmnyaZq9nlgyOqA9Qd14ooXcr52HgUva7A3ykm9XrVOLG3N1UD3oIKb3b1teaxI52mn_pZpI4afS7fN4IE43lddKCwh6oHzXiKz035RhLd5kenFoecBpwo2O0ZAaCghdlDdsUDqxQiiCw_zUWvpJE0kySta1HnSMLO0IeXpNeDq0OBC0YOM7MmV6HGGIMsaQKzYbL_BSebtRTUbogic1iotNEffw2eTa0KHe6OsDJmPa2elefknoUB36UcAAwRwldIz1niA_5TyyIlnpzAHJ1NrBk4iB7qL1 hZkT5GCcFv tHD3JNw0qbxt0hlPPKLO4rfG7sUm789EtJcWDzeK6xgcE8E8REeMadyLSW24fVdG1u3q2oYKiQg0Je9h0PSbQPpHOYlM62Ha9Tz7UxniVFBORMc5pOcFTQpUjMWsFHRlcK6TNleh7kdhe6qFszCjM0C0P93YShIydY6GeIdz13uOY8pRc=-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=-e

http://www.factorycapitalstock.com/M0RRbAcv9QZ_jTu92ZKr_4n5srVKhXt6JxltI1e6ipMr79zk_5XYySMtb2NftRYKHNsHP6A6CeEnPT7mWX7TOxpCjoHO7CR2krBP9 yV1w7bwqJ2LnApc8BYy5W78Gs64Qf5UCg2qtJyHXVr0KqIb7_BKEEcbBKiCj_ufVqnhA7Q81LgEt8q3JHlOHt6zV9Kfg1IuDQGkApBSgLtubiGFDW VCz6g==-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=

http://www.funtourbundle.com/idwqNbhwEgpMIXl2FIKAKn5D1q8l8vLdAnqfjVEyYWUcOX2_I4s47iEfhCicN9m8q7KzEqDbFMH6NSq1hDI4Zk Y3rsXqKFKcQo1fIBBsbe46beSN0OETUnL9UcuoSgzpu8eb572rggppGM9QjS93Q4UfIyrlms6 UhzRFmDQV7vW2sMmML5mgTe_ygxQxaNv5XzKwnIPiBFlLrhH X4_BU43fGrcZDbsL9rKdclLN5IamKRrDjU0r8S4EYHWbwTqBHIMh0ZUOSIdQz9NLJH6M3dsg5w0Mva9e8doagx4gVNck4ux8DV9trJqPPKNEhlp327Nkgc4xdnmi8iu_ wb1E 5t5VCvOQdWIBM 4RByN7Dyzt87rdh5mkCir b5ZyTuWxlkSzgdt3Wb2iyOGe65e1NNYhTmJ2DxbXgKLmqj6sKaXz533Uc_viSMA0Bcimeoq8hlxpcA1MmShmWD8kHDQz6s891LHvWMRPJOegOpvJv_D8RsE=-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=-e

http://www.factorycapitalstock.com/zJJpEfFpIPg4vZ3h1fSS2BjrtQKSIBeKRtMOM Gc2tDz Tdr3I_Bm5OA 92G61iIUQjPME6TraQMlrLp6GJl2dSBcU GDIYo_uquC8Aq1jVXBv9xh1VdB7lLh7UJFYe87Q7G1Aeva5BF6ca2rdqme5kXLxaYR5WT4a4xpfe4NwsdJQ8baWIPEvu5rVWHJvYAmjg3mv87rvDKGIy4NfODYvDHpqaPqw==-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=

http://www.taggiftflash.com/Hljx8D9BpiH_qKVsPmUR29voLlzaQmvcODE5xXfyx31eqI9KZjdGnhGcEdMxJc9F4urxy7sEAMkk2YRp0CaOcOTVnLoz3ODsNP0yKTy vGX9 cJFETV22BF SeBCmSDTV1ePCAarVHWvn4 3nOtQHHMgTP9hsO3jV84taJzzOydSUquOH1nKTSz_mPvzifguCQklmDmc2prl8Vl9Y5Fa_IYugi7O_9s4RPw5XeKs 4HUQDfiNXRXgNTMhcF5N9OdfzWBq5qZvw4eT _jsgHqQOQI6x5SRu98c27xm6M1IXdxVvOLEOqL0XgBvPt kAdTKSr68Ucjh62eHy MJFMe2ZoX4g8EV11DRgMz3ZpMN6R0H8sG0R4FOApwS5B4YG93J wD26zINUOYgSpZyAHCGm5HnU3Fe2LzAkV2sslOx0klWHqX_TYENEuZqRHb6AjYUJur48ktfPZ_37g62bmsGQGpQVuhtbjTTyXROXsxHLQRk5zFTJw=-GyIAAAQccgohBeG3ltSCFDJJLWBj7CyXEvnGxIeO6nhyZWo=-e

Remove audioconvertmergefree.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.