» bitzipper2015trialsetupfr.exe
Overview
Analysis
File Details
Downloads (3)

bitzipper2015trialsetupfr.exe

BitZipper

Bitberry Software ApS

The application bitzipper2015trialsetupfr.exe, “Ouvrir 47 types de fichiers compressés : RAR, ZIP, ISO ... ” by Bitberry Software ApS has been detected as a potentially unwanted program by 17 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore monetization download manager to download additional third party applications that may be unwanted by the user. The file has been seen being downloaded from trials.bitzipper.com and multiple other hosts.

File name:

Publisher:

Bitberry Software (signed by Bitberry Software ApS)

Product:

BitZipper

Description:

Ouvrir 47 types de fichiers compressés : RAR, ZIP, ISO ...

Version:

2015.14.12.3

MD5:

89f8c6996fc16d2e8ed49b627f85fb65

SHA-1:

18c0017a29e0541db6d459880ef841080b79cb9e

SHA-256:

1d85fbbec3dc2545167c9205b4a9a58d4a8383bd57c35d188da9dc01166583cc

Scanner detections:

17 / 68

Status:

Potentially unwanted

Analysis date:

12/26/2024 12:14:48 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Win32.Sality.3

588

avast!

Win32:Kukacka

2014.9-150626

AVG

Win32/Sality

2016.0.3066

Dr.Web

Win32.Sector.30

9.0.1.079

Emsisoft Anti-Malware

Win32.Sality

8.15.06.26.06

ESET NOD32

Win32/Sality.NBA virus

9.7.0.302.0

Fortinet FortiGate

Riskware/FileTypeAssistant

3/20/2015

F-Prot

W32/Sality.E.gen

v6.4.6.5.141

F-Secure

Win32.Sality.3

11.2015-26-06_6

herdProtect (fuzzy)

variant of bitzipper2015trialsetupes.exe

2015.6.26.17

K7 AntiVirus

Trojan

13.202.15327

Kaspersky

Virus.Win32.Sality

14.0.0.1826

McAfee

Virus.W32/Sality.gen.z

5600.6820

Norman

Win32.Sality.3

11.20150626

Reason Heuristics

PUP.Optional.Installer.Bitberry

15.3.20.22

Sophos

Install Core Click run software

4.98

VIPRE Antivirus

Trojan.Win32.Generic

38600

File size:

5.8 MB (6,125,136 bytes)

Product version:

2015.14.12.3

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\programs\bitzipper2015trialsetupfr.exe

Digital Signature

Signed by:

Bitberry Software ApS

Authority:

VeriSign, Inc.

Valid from:

9/20/2013 12:00:00 AM

Valid to:

11/18/2016 11:59:59 PM

Subject:

CN=Bitberry Software ApS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Bitberry Software ApS, L=Holbæk, S=Alberta, C=DK

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

23118AB330BEB5704ADCCE30BBB04D23

File PE Metadata

Compilation timestamp:

6/19/1992 10:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:lH+OyWZCUdGY4BlRz/WveVH2FnUlsxKI8ec4ZDjARtuKWig4eX61Iy16uPLU/NX0:NOUdGY4PkeVHbeKtec4ZDjEkS+qey1Dx

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file bitzipper2015trialsetupfr.exe has been seen being distributed by the following 3 URLs.

http://trials.bitzipper.com/bz/full/.../BitZipper2015TrialSetupFr.exe

http://bitberry.cachefly.net/bz/full/.../BitZipper2015TrialSetupFr.exe

http://www.bitzipper.com/.../BitZipper2015TrialSetupFr.exe

Remove bitzipper2015trialsetupfr.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.