home

burn4free_dvd_copy.exe

Dane

AVSoftware Ltd

The application burn4free_dvd_copy.exe, “Dane Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from hyperurl.co and multiple other hosts.
Publisher:
Kefahule   (signed by AVSoftware Ltd)

Product:
Dane

Description:
Dane Setup

MD5:
f923c3a32ef3a4a6ab095eca01d6298e

SHA-1:
efca0826f0341fa619a6c48a9394325f66fda916

SHA-256:
59bf9c572322a2ed0e8e48f363442afef2e8358e4103e111106c0ad213576741

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/5/2024 8:24:02 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.3.30.16

File size:
1023.1 KB (1,047,680 bytes)

Product version:
4.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 3:55:52 PM

Valid to:
12/31/2016 3:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UpN+OOqPulgLwEtH0H6y7sd7Nxlot2Owh6HeVCiaawV:UTlPWgLwaUH6yao7HeDTw

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file burn4free_dvd_copy.exe has been seen being distributed by the following 9 URLs.

http://hyperurl.co/rf773m

http://burn4free.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWt0sI8aa3KPl0C9oyM84N0MfBu0Uc p0awMca3IyQxMJjMloAbGqQ7XLg0AHEJdy/MIQmR9nFXx mWXFpS/.../MWzGH4I=

http://directdownload.burn4free.com/burn4free_setup.exe

http://directdownload.burn4free.com/burn4free-setup-silent.exe

http://www.tourscentralclear.com/c?x=ubxOX4M83l6uFzfXgQRe92SV4/u4OiOf1n8gFrZFgkc=&c=Ov35Aui5MtsQVRFQRV9CkpnEzxX7CITjNKrLpKo3d43s82m6DZxSVWmjGXt74CroBrHnzYDBi1p01Pc3X6jC h6GowrugXdJWei2eFiA6JdK3iP8yxsjUgcaNzOxxsF8&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://www.tourscentralclear.com/c?x=j3UXS2INOOfX7ESIlSZtOoVcN J76FP9zy5BekyRy/s=&c=0F7tmF Z Q34/Qf gts2dxyVzLe12OfO7NvpydL6yfbsm P74DOIyhImpyZ9Uf3zDrwht4CjtO44R1f7I9QToi/c71fWJhPDcpvXbHjvegsdwFrzxm3TFQqvN9l/RXvP&downloadAs=Burn4Free_DVD_Copy.exe&fallback_url=http://.../burn4free-setup-silent.exe

http://r.burn4free.com/burn4free-download.php

http://download.ilsimo.com/Burn4Free_DVD_Copy.exe

https://mega.nz/temporary/.../NRpFSSYC

Remove burn4free_dvd_copy.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.