home

c.exe

Soft Installer Program

Media Theory (New Media Holdings Ltd)

The application c.exe, “Soft Installer Program Setup ” by Media Theory (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.grabpresentapplication.com and multiple other hosts.
Publisher:
Software Installer Web   (signed by Media Theory (New Media Holdings Ltd))

Product:
Soft Installer Program

Description:
Soft Installer Program Setup

Version:
2.6.5.3

MD5:
128b1d8e60c9196af9b827b1e880a82c

SHA-1:
580d4aac117e9e84c0b3dfd274534b6b786ed79b

SHA-256:
b6e9b906d09e2cf1d15b0d79120e4d80512abaf2fab7d9a499d4011389d44788

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 7:32:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
15.12.24.0

File size:
959.7 KB (982,776 bytes)

Product version:
2.6.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

Digital Signature
Signed by:
Media Theory (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
5/25/2015 7:37:49 AM

Valid to:
5/25/2016 7:37:49 AM

Subject:
CN=Media Theory (New Media Holdings Ltd), O=Media Theory (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA944A31E4793A274CC4ADECFF1E7349

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UzUYA+88/qxmNIqyIHgVRP0zKfyxHQr98X:UzZANMgmuvIu8w

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9334

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file c.exe has been seen being distributed by the following 14 URLs.

http://www.grabpresentapplication.com/c?x=xtEWX50BLUF9j12iRlgDVzkj7pZ/A A oiMRZZDCjT4=&c=vm/JjB/4VvUTIh/4znrcIlVFC6n3NoPqsxsKFx60nn79 Rqiz puamLfhu6/opuGsseXGh7yp8ddExrErYyugPbiQyUTBQOjtoVY6ws78qIfbQpAS54DVhyeHFf7GOHsjeDVYk5WIRj1l2Pna85NFg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.dldeliverygrab.com/c?x=KYQVFX3adyEy5klH6XAxAlBOOjOdLFUlJ17ktFElc0M=&c=jWYnrMymHR8USkeq4CGwjE8QRMI6KXO1KFoEvHY5AE5SwfydTH8VZVDKQNzzz20Pxm7JFt3FvMn/QqHqMeV49TTFWX42ipxiKzrXF7x pFcC DJM2sZcM49kO4YKIGtVy6C4RSfyGfoJG/5ZQvmgBA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=pGFI1147JI/3jWyzM5cQEt9VpzLmCd51vJBv6qpFMX0=&c=goBavR11dTzAF41cicZG13nS99TK7ThtQQ/3lfgLxG3ssB0jkElkfSpw8e19jNeUeymE8RTE5ccbpNcSs4bo5u7W4KZuMbmGFev6A6CwbHlfn1Zj0EQyHj5zzU6n6HVOcnE4DYSoYkpo668SCQe07w==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=Bogz5YspLnTE5xuOMAgEYWfpamt8aucPr3enomCUM3o=&c=Z73ply4CVLcz1HnglpT46e1ZACmbpsNo9tASkaZLFzRmeraec8Qlkf paeoqs/oJ7UAEWgj7OvUyfEEeZZxJMHj EJ0qgOiP3Zdye3fnm2g SNk9zjTVs9Zl04veSKjvnWB9an67MIKDT BJwEiz2g==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.dldeliverygrab.com/c?x=epifjcdoQxPxRScgjeiC OkFBWlEbzK8XaS YcU4nPk=&c=Tpbc8aHnpEFINnJxFL38Ydv3h9e51bthUoM5rPmatIVRds0Slzgh/DMW45XeYyZpM757/xHdyomquuSlQR5mvkRi4TNlyFU7v2H1IMxEuNgKiHmSk5QGAa/ULAqVUk TNqhCsBh91lQvJ25gaj57QQ==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=9igJ1YSAWQbBA34SWcQ7ynt3r0gbZtQ/vQ2 byDkA2o=&c=eYigVUSK6aEszug4rlprX5y4ImFeo/9udcIURMB12ty jbej7BKxza9 Km148cJQ5JWyzJfXKutlsNOjCGZIJj5KTpJVO3oMkCxgfoAPD94E3eUsYmGbRoYKHEvEds8UMuTf9qqIp20QxoJyB BTUw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=U3RI4f1XbnqGwxnVPRNSQcVaZLW2FNWbkRiwvwynqec=&c=NuNCMP1sH6 /H66FFED8Dp8yUKiBDNjO58L8g/s0Ckteg5kvaa2/nDV2/caVp44XPin ISHxehY0yg9yMtE2BsjoqDxcpO76Exe8kj4OqYIpPV5mClvTm DpXqRufyF1aOmtyHchlavNwv21H2 p9w==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=fxwwhxpKlmf/hYZD2cX T/OfvxYJRhZXF8SxANVJzN4=&c=yjKs9MDlR3eQq2H4Sa2yu8Gk0pi oFm0w5EurZ27CEwUdHqlq6eaXlU GGHGqGoRHym58lsam2hAb1Wtn8ekn9XwiJ1GA9K1l7fPE356 hbf9LViipTko F5OAyPDAn26IMuDpLQLtzKq2BZ32TFIA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=MR2eWcXGH3CQa8VB6/m24uQI RTcJ0FVoYTXFXzSHcM=&c=qxI1lg0X9tt8/gNH4SxnSkfSAdDIqWzaWZmJR35Hh s7cWVzZmu9cb6s07rzD PhX1DlokR53MsC5ENsxyu1JiqaTVAk6kWlmJ2D4hkjNh06AbASkvfhuXwG5gOtd8xrcMMYPQTTtFmQPo2pPoQvfQ==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.contentpresentfactory.com/c?x=Zjr3SMrh1qB 9XDV5opRbcc6z8Tl/V24wsKoH91QiUA=&c=BOrOs3/xc8btRwH8k3fznyZ 7nY3 f26aIKU99NEUVjckW8GYNMkJ1Q 9BgALlMj4eLyTNDHRyelMCASoigtrHEg9CrznydtPg cvxgPf1sT7JZq9rjLubiLaNS8WgztUaUoFQMvE5/nbaPkRaMzOg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=ui2gtGB1Y8qicwOs2zgmC15Y3p8ApiRNSO2ncSMNpkA=&c=fpT8EmubPF9DIXmuEKqS 8k84Zz7Nir9OgX31IdDsnTM rcprK4j0pHqEiHhafuA3Wt GW6Xp8nwkewvSVbvgT81YIADZcKxLeqLneCEWggwO1bSZpV3Lzkt068rN7R1rBYuf n 0kO6aBCzRwgGXg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=TgI4kr3o2MuEnY3ao2turSB0Yka8q3RXoIWGdI6HKgQ=&c=iqTZuaT8mhMGvScmPKl87Wuh/6yDoxlzJ/Kmfxc4mvXl/4bab18UzU4WB1932Xnx6DQZZSfIhPdrxfXv7bzygwLKq 8BjWetkq/ xJgUrq2xgzqboREf5rpVTrkuh4R0qAkONfqbotvw/FOJGxo2Nw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.megatourapplications.com/c?x=tWYEv2tIIbe3eMpS0YA t3xlCJGR/W7xcVD0iz0LqMM=&c=rCW6kj5r0KzP/BuvV744vuYD9EJdho43FhFy66YUk 88W1DaMTGEmjgNEZC6MRjva3wG0VTjiPMrUnJ/DjeLis4HavW1ZFHfuvz/eTDVDsjaE5n7PH2uCD9s/hkx4QqRKvmEk9O0QqzfdqnH2kmUtw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.applicationstodayvault.com/c?x=cJvpGAquLVHPMVJyo2BXMZf/ig54kSg0gqSQd1 sqdM=&c=Fwu02W130IW4RenkCOQIK3 OWRsTuJ/yFldC8HB6QAanC0jGQtpdVPAPYUkJ9rIvD9YwjEuu3gn7 B4E0oJkMpJA4acVoac3udq5FLQxSyQDkBQZ4bSkRjF4xNOd20XS4qat9uL84WGuWVBtfUHAiw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.