home

cea83870-8f7f-2c70-96b9-5513a229ec72_1d1f17a6d27ca8f

Radufa

Sambamedia llc

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file cea83870-8f7f-2c70-96b9-5513a229ec72_1d1f17a6d27ca8f, “Radufa Setup ” by Sambamedia llc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer.
Publisher:
Sambamedia llc  (signed and verified)

Product:
Radufa

Description:
Radufa Setup

Version:
1.3.4.2

MD5:
6c55cbea77d030b316df725b6f234f07

SHA-1:
1c32aef041fd065c114f9dd1d4626cb9e55ea9fb

SHA-256:
fdcd2195a516116e1820bad7be8c11ae7293a6fda8561ef38a1e9280cbf5c836

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 9:30:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.7.13

File size:
942.6 KB (965,256 bytes)

Product version:
5.1

Copyright:
Stub

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Language:
Language Neutral

Common path:
C:\ProgramData\microsoft\microsoft antimalware\scans\filesstash\cea83870-8f7f-2c70-96b9-5513a229ec72_1d1f17a6d27ca8f

Digital Signature
Signed by:
Sambamedia llc

Authority:
thawte, Inc.

Valid from:
12/20/2015 9:00:00 PM

Valid to:
1/19/2017 8:59:59 PM

Subject:
CN=Sambamedia llc, O=Sambamedia llc, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
08AF0B7DB5193EDC6FFE31467E46AA55

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Aijs6YE7Ykjt0B1R9GO9CkKetgJXtaci/jByl7uR:NnYYlhs3ILJXUci9yO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file cea83870-8f7f-2c70-96b9-5513a229ec72_1d1f17a6d27ca8f has been seen being distributed by the following URL.

http://www.filesn42.com/ypkSpUDrezxoMwPet26GG92kCbcVJyhzPoxLMAyCLcDoiSwuwvR8C0quUj0LjniaEP HMkyUNa ai_qemte9zhFKa85ur2Jq0es_DRGmSH93Nlh3oyaqLuNjeDWuuZD_JNGX40Z50qNwZfaPDFkApby7enjtPnlSZ5opal6BXN8McqRZH5wobQKPuqus P7BobOyKEq akvSEar3GH6dvynTDWaotpOpMfJsj44aAXycOEXTG4FltvJQofFOv1jiYTTjpV9Lwna0GZv1KleYuKIkrH3_LbmcvA4EqV_efvVL5zeeiBvMBKuNT9DNuPWydHk9you_4LUDGd5_obRKm2eREesvoCd8Tm97nsZizs 28Ed1Uni2eJ5gg6XYE0gnkpEiuNysvV3dCde85a6scN89FOFAB7H9v FbV qoQ0BzM597hppURifSV9UWu7VKgmtjwP0_KWvQ29BcpwtTzHrkIj7OlB_0wvxHOOaeTa68htAet5t8tZaNTGKjyNpiXA3pjUnnlwFneUPAzmX87gG5CH7vTALrAqycrjHyC6Fhu0lnqvm5Yr6U9hibi 7b0NTpb8TQ-iwSAMTcyLjE3LjAuMQM=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.