home

burn4free_dvd_copy.exe

Application software

AVSoftware Ltd

The application burn4free_dvd_copy.exe, “Application software Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.downloadgiftmeta.com and multiple other hosts.
Publisher:
Lite   (signed by AVSoftware Ltd)

Product:
Application software

Description:
Application software Setup

Version:
1.6.3.8

MD5:
3a678534935f4fe916ca953d8c262380

SHA-1:
8c16c44abff302c01b9cfe1f4b9caabe74182afd

SHA-256:
fd2d78fd3d0fc80735e3df1ef7789ee766d254fa89f9467c64a33234e82c313b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
3/16/2025 8:01:24 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftware.Installer (M)
16.2.4.17

File size:
943.8 KB (966,440 bytes)

Product version:
2.3.4

Copyright:
Installer Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\burn4free_dvd_copy.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 10:55:52 PM

Valid to:
12/31/2016 10:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:sPhTG2mTAzbBuATMjquwO1SVdA7F5KFasAbpup+7xZuCDVj:sRX1zluAT/u2S77upvCDVj

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9283

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file burn4free_dvd_copy.exe has been seen being distributed by the following 7 URLs.

http://www.downloadgiftmeta.com/c?x=s7Gfk3A5 nPPDT/eAgABAbGl6ht5Y/JUjtY74M1njjE=&c=JczW14TyuMz5o3ofjXUFXrFjY NsdjrU6XYmPaOVCOyILS0VQwNoiKnsiFu3rlbSqZKk/Oh35bX dXjP5Lx0254f5N2OBYiUeoOw0NpAAFFgyssLDnlmt4dD ECzWbwG&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.factorymegatour.com/c?x=J5tqLjlOqZbGpboViCsrIU0TePrkagDrbzDwl06GfkA=&c=bf0CauddI6JE QsGekAbgmPw9LOUUL4Ti5i8ZP7BnzFsTvlO6RkefrgqeIkAxrrSj DS9y9oGL3G1Ai UedJNNbxXVLoQWxwfsc5qAAXaiHC3wjxbKY9iCYu1R6rqLa7&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.factorymegatour.com/c?x=sljZcoUePtjj1chcUdqKqGeCR86wBX7Y3YasEtijxww=&c=/ZDcrsqRidvp wWjsEGN0wRbvnD61qlIqL9zgSqpfdJMBE/gE2wQp vAe O7klb/pZE88NHZcNi07ES5Zk6hJgujLaavjPGloeDjX5sf qAF/A5wR8ljZ44nJ1bOFiVh&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.grabtourranch.com/c?x=i52SXZVVlqqYdWVPY0NdnWR4YkaPvsm0iHL9H9p3zL8=&c=o7vwnTFNaYK1zOHCQmwLkBlmxp/Jz5cufAZWjwHQCY3KFhxx0Z1Z17aAWEZa9FbT2wyOA1wZfZu0e7 EPBpcTPgAHUquh7BAM3BnTaYAKf6zf5JSEN vfTc zWFP3eYX&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.bitsbodyapps.com/c?x=knsvwL TGFx0kt6l2RO79RyXy3dgYS1q9wvGzL4UQSE=&c=ZlaRQYmyvtlOp1mkdadinb8KuzgRFxSDtdavPeTzWMrSUYIJDD2BHmC4uXnuyj19HcvpfVZvZ2G92f4Oxuo5jmb483 8uvE/kpApMYpwCGmoEdKY8fCO9j8svTh2nt9o&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.grabtourranch.com/c?x=JqnrAC2F9jfKRwN45OyDNzKDgQVK4oaHLdTkhZzoUJA=&c=rNiF1p9mWfe5pkpX4vy2odySIPdmUbGqHhvZJb7mpXhzeysILKReIxk06GGtMqhMgK2yUIJcHVmo6m/5V28Djf zgCTDTZnUfzKVa8WhQ8ktSsi0T/v0HPSHnAqL9Nk1&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.todayappshosting.com/c?x=ze8PCH1pKs4Tb9OYt7pL0m7eLgvfiYCQ9srbSbGbF9o=&c=O4h/UBIFP2IO0clVdxnTmLDX8FJE14kw6R81qtI2so7S1WqWHUQuJa4x2EzfpgOQs1vGQM3iH P5ZiBT4IxZcLGuuGhapKuQAhIK6khtrGFTNTrxiOyk0zj6hAqasveY&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

Remove burn4free_dvd_copy.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.