home

c.exe

Internet

SuperMoca (New Media Holdings Ltd.)

The application c.exe, “Internet Setup ” by SuperMoca (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.citycleantour.com and multiple other hosts.
Publisher:
Installer   (signed by SuperMoca (New Media Holdings Ltd.))

Product:
Internet

Description:
Internet Setup

Version:
4.1.5.4

MD5:
de716c8c20d4104766b4571cc6ada947

SHA-1:
0511f0e4d05f1479c011880a0dd91c81ba9fb53f

SHA-256:
959bddee72f7d012db4d818824b8e099e63e3490c99394ffd9935e73942add0d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/6/2024 8:26:25 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.13.7

File size:
885.4 KB (906,608 bytes)

Product version:
3.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

Digital Signature
Signed by:
SuperMoca (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:18:05 PM

Valid to:
3/23/2016 4:24:07 PM

Subject:
CN=SuperMoca (New Media Holdings Ltd.), O=SuperMoca (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DDA99F01EE6D7FC1C948433B608BFC09

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OQ8S0DAuzck3J7JJq0a7psH0iG65wvbF+alZgOF5u:O7VMul51O7psS65wjc2ZLu

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file c.exe has been seen being distributed by the following 11 URLs.

http://www.citycleantour.com/c?x=Y/pjhG13zPNgyCEpHgK2UVfUcE432A6OKE5M/bQzxq8=&c=Loskeag2hCs CWGTNbOphM5vlAjv8FknuP5IKk7HyH8EgaNKUbA8UgzYuDIMT8SycHHqemfBD1gqsL043mucoimTLx X6ZsDnkKf9TqCPlaoEmaXMS/wRcZdNm7RVCwT&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.funapplicationssend.com/c?x=TOS21PxjY4q7EZNUxLD/u/kcoJOj5M5otO JLhRbrtM=&c=IAW2SKSDjSZLAnoeqsJ5P s/GyrvKqXpf8ygrvqZ1QufKbTQksU0NYlY 7ESKYnyFj/M8xFI53WK5sfSLYEngWqUyaPSfaj4N3LoArXQp1ArT0eUkH8f9 U3Ok4miTLz&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.factorycyclestock.com/c?x=hlcokAsdFu9shMSB nYyKiz8JWxi/3BuSL7rGhjSZP0=&c=WcPHO3yl1u0jnDpOsNHyNx4xUm7MrPQKDIF5HgkWFIalnhDaHo9/Az8/ASKttoA4/VieeGXI2hhs1yPq1H3q6m8LQR0uo2R1FbQ5mOzl 3bNp9rEVwDdnUHb7R/M/C/0&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.filenewfactory.com/c?x=XdpJ67oOPk3r9FnPoLfX0yK30uUfry1TEkZgyfpKskQ=&c=DAuXa2KchrTvGK34MA678B RiFaXXYfTD2mOO HRGtWtRIPLo1TYDVJbdPcKg5YFOhvkSa1ADWhScHkWMKEcQmt/7FT2q zoEZ5cton8YfqdFTA7So1IkC9NrlqkGY3a&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstockapplications.com/c?x=VFTtYP u7M1HkViLfyock1QsQSE47Jh0Q5G QVrykGY=&c=DEx8KpzKKrI2jUazu5V8VcTnaUy9q wkDzHtTTTCBUDjbtXJ85MAa9OC1U1KiP6LsDHBo1MiyySPzKw5tcQkZvtktarhoa4JScue35c3YRFyd3xfi jehkVsciyDm7YL&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.megasignsbits.com/c?x=TZvlZHN3MuNlxhe5Wwg2n0fZJuHHFJIZ/Z4L5MyufJI=&c=Pw5oPQqScCeeNbH0FXC3yfLWZ9CpSyubAKzbIWELrqDCV hDopDCQ3padwIam7H2nhjvW4pfExmcIkqc6yqQiKEMDaTRizKzd8xSTr4UA2qJXWekjuA18Xx7ZJbPafuU&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bytedltower.com/c?x=KAyvTDva1hOW9V4hm152b0vTG35/zeBjahXH29w3Mpc=&c=/l3 xTO3neTOUSooCCe7GQTMjFwpmzxVgEgwzQpIvq nFopfUK4JQTuMigN01VBCUUxc1IcvLWZoBOx5/ktFXuu9IzTSD2UK7mszPtVUjfu0fYxYNld KvH2WbCZY3jr&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.hostingnewcurrent.com/c?x=58O3zT5OddwBmjtiT5svP1yT06ArYkgmahhqWjQQlB8=&c=R3UeRCix2UTF M2idd6XIYsJeNwjJRCMMlVUbZMcAeFkSFuBrGRn5gQKYb8g4dj43Vwp8QA0O9hO7IQJLcfa5S/0gz3HWjddqkUQ5xQyGvqBGuAbtV5gpOUZIP5OWkQh&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.updatesoftwarelaboratory.com/c?x=N6DADKdr60G28O7KsU sNTtvDZlFYf7LDNyDHF3kE30=&c=0L4Z3Z3SFd vagLIg9wIFQ6nubL0vwyL8VQsIGMDSJPAgTNnuomEuLDGtUMhuHS3CY1XTOlnHEK7f3nAN/izU4yCOs2owE4j8WO7dUG/zFwVfnBxFbd JWBPK03oEq/C&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.presentflashlaboratory.com/c?x=8/4S0SgQV42h2kb0wp4EqYoH6uhjmaoz14zYBRqEBS0=&c=P6uVmb6Fu7Lz4CcXO65be4R692fuwknSdP5wRl3wJTfO7mXfkbc2o381iv8iYB7D2sqLUC1LrYj7KnGSBxKqxy/0BNnKpPUqAjCly0sNGjhn/a0HMZwQ6AhSzcSPF6Av&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.sendmegagift.com/c?x=v2mUwgSCKwuYngsZPBGRrSD3zg606LFJQt56shH3GUs=&c=8HNMPjVPkHBXUE4eVcRm5z7BBwMuUEKUyxwsmtg/IRtEZA1u MZQ2IHqpwDdGRdZmojrbwA1aHEDwVaUbXyb32RK3x6XQL1Wm1Rlt0JaEqbkZt9 YSv0GeAg9hAAu4Hk&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.