home

c.exe

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The application c.exe, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.bundlecentralbulk.com and multiple other hosts.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
7fc878a68b83d5a5b2104a2b2a8d3b83

SHA-1:
12ccfb6736eb294214b8d41cb6476b1527849712

SHA-256:
54a9e0fce4e20fd159f34e315aef23fdd0ad652f96a07cb1540dfd9ea82990f6

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 6:15:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.20.20

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:BKSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:BreTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9306

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file c.exe has been seen being distributed by the following 6 URLs.

http://www.bundlecentralbulk.com/c?x=/BhQgFcJcnm1PT8sd/vayeMKNPZ 01LFY7P2Fv4Uz6s=&c=sugGNksQykP J0D85i/oHK7BjytlefSWVsF4ZGgqC6Wa8FyEa/fZL6D8V83EI0su/mqtFLxAL3lGp6NHLJL sDGHgy4s39whl6eZWXuOJUC2UOqw H6qFd4Bk Ul01afpI8q9Q uRY9stgzYxsiwMld7f7T9Ix6 lIZ5ra4wV5Q=&e=0&downloadAs=gta-san-andreas-hot-coffee-programas-gratis-net.exe&fallback_url=http://.../GTAHotCoffeeMod_2_1.zip

http://www.sendtowersnew.com/WVl6OTRQVmRrZEhaT1MwaDJUelo2ZW5Oc2MwUXhSRFpCWTB0a1VDVXlRbWxTZGpoaGVVSnlZMkYxWkZwMWFXZGFVU1V6UkNaalBXOW9ZbVF5VWxKRk1sUllXSGhVU1ZsSE1UQnlRbnBQVlhoU05ucHlaelJsUzBkcVZVOVZPQ1V5UWs5d1QwaDViMGxTT0VwMVRtdzVXV1oyWm5aYUpUSkNiV28yVUV4V1V6SXlRa1JrTlVOYVprZHlWbUkwUzI5c2RFSjViVGhXYlc5WWNVWkxiRzlXU2xrM1QxSnpKVEpDU0ZKUVNGSjNUWEV3WW1kMFpGRm1TMWx1VVdacVpVRXhRamhpYWpKeFNqZHZTSEYzYlhJbE1rSm9SVlYzSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBXZDBZUzF6WVc0dFlXNWtjbVZoY3kxb2IzUXRZMjltWm1WbExYQnliMmR5WVcxaGN5MW5jbUYwYVhNdGJtVjBMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1acGJHVnpMbVJ2ZDI1c2IyRmtjSEp2WjNKaGJXRnpMbU52YlNVeVJrZFVRVWh2ZEVOdlptWmxaVTF2WkY4eVh6RXVlbWx3

http://www.sendtowersnew.com/WVl6OTRQVzlYTldScllrUlJKVEpDSlRKR1VGbDZURlk0SlRKQ2MxVnVXRUl6WlVvelZubGhKVEpHWTBack4zVk5Za2REUjBKaFl5VXpSQ1pqUFVORFlYZDVUblJPYTBGak5uZFpObkI0UTI4MkpUSkdZU1V5Um13MU1URXdlWFZVUkdkdGFtZE1kWGhzT1U1eVdHazFRak5aWW5kYWFHVllWalEzUmxVNVV6QjZlVlJWTTBGeGJsRldZbGhtUTNKWVRrTWxNa1l5VGpWdU1EY3pZakJEUTBoelNESk5jV2RoWTFkWVRUVlFNRTVMWldGc09UbGhha2xsU1cxSVNTVXlSbkpRUmxvbE1rSmlSRlExVlcxTFFXdFVhRVZSTWxsT2VHSjFNMmNsTTBRbE0wUW1aVDB3Sm1SdmQyNXNiMkZrUVhNOVozUmhMWE5oYmkxaGJtUnlaV0Z6TFdodmRDMWpiMlptWldVdGNISnZaM0poYldGekxXZHlZWFJwY3kxdVpYUXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHWm1sc1pYTXVaRzkzYm14dllXUndjbTluY21GdFlYTXVZMjl0SlRKR1IxUkJTRzkwUTI5bVptVmxUVzlrWHpKZk1TNTZhWEE9

http://www.sendtowersnew.com/c?x=JS3rCQuITcLe8LSznAorxY4K6OKP0nRqfqN5zFo /3M=&c=2J9oQRzX2GIi1OBmFtmn4syNiCzX8w11/TFv1hIM4a5qNumcgLZhjUM SaxpJJhPOyMQ0n5QTt93Ryoj13nQfxuj0PIiMfZnNjUiye90qiw10rBV6RLQji6zq6m Svdp98ct/RrSwhTEpUdzd7stQuEDJkY563rxZZVcB6au9KQ=&e=0&downloadAs=gta-san-andreas-hot-coffee-programas-gratis-net.exe&fallback_url=http://.../GTAHotCoffeeMod_2_1.zip

http://www.giftbulkstock.com/c?x=7z2Jy0KzOkRUBt3guQ8wiEZ9L2/l0AcbtEeiBVeHQfs=&c=uw 2GzqK2llf0i3diAULOdXiJnv xmmJBVAE4cpTOEV5GfiCTQWk7iKeiOAYK2onSLWFpFd7AKc6h6zXge3XQLOcoqkwdMVOEpID/ZZn8Bj9lB67lu8Xgbk Q 0LPzr28X//Alo8Lc c9S9csyIfkq80MGihvBQUEnpckY14D6GtFoXHLzykXcDubB8bDtjm&e=0&downloadAs=gta-san-andreas-hot-coffee-programas-gratis-net.exe&fallback_url=http://.../GTAHotCoffeeMod_2_1.zip

http://www.newsendtag.com/c?x=YpQhDTxKG7RySXTbi6iL14ndZftKJBGlrtbVhPMb0qI=&c=MJg4I4Xttzq4VM7hsQeI7NmLuQByahhQCkzucJFwWu2WTi1yBe Y4Ouk9eSqQGzX1/JeVxDWqE6m7NVcCJrfz91t3ioxZbjUUxBrCoYqhtMmRp vSV81mKKQjaDg7gdq0tMDOFKjLOSjSVfxrSE9IA==&downloadAs=gta-san-andreas-hot-coffee-programas-gratis-net.exe&fallback_url=http://.../GTAHotCoffeeMod_2_1.zip

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.