clash of clans for pc setup.exe

Clash of Clans for PC

Download Helper

This is part of the Air Installer, a download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application clash of clans for pc setup.exe by Download Helper has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the AirInstaller Download Manager installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from b.softwaredownloads12.com.
Publisher:
Download Helper  (signed and verified)

Product:
Clash of Clans for PC

Version:
3.0.0.126

MD5:
8a72689c8b8d18c7059fc7491ab4a11e

SHA-1:
ca2bb4858d574afd254a759a8b03862e920a0c78

SHA-256:
736022f4b183346860040e703c4247e884264b750aaeec1854dee6bb65ca26fb

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/24/2025 11:31:02 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Air Software.Download.Bundler (M)
16.5.30.9

File size:
1.1 MB (1,131,072 bytes)

Product version:
3.0.0.126

Copyright:
(c) Download Helper

File type:
Executable application (Win32 EXE)

Bundler/Installer:
AirInstaller Download Manager

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\clash of clans for pc setup.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
5/27/2015 5:00:00 PM

Valid to:
5/27/2016 4:59:59 PM

Subject:
CN=Download Helper, O=Download Helper, STREET=308-536 Herald St, L=Victoria, S=BC, PostalCode=V8W1S5, C=CA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
587E926923738FC7352E590BDCC12DB9

File PE Metadata
Compilation timestamp:
1/30/2013 6:21:56 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:8xGn7KbAmTnuaznSFJEzgaKENyyKMKAio1OdXzMC2:B70nTZzn22gaK/qKbgSz2

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86...
 
[+]

Entropy:
6.9511

Developed / compiled with:
Microsoft Visual C++

Code size:
65.5 KB (67,072 bytes)

The file clash of clans for pc setup.exe has been seen being distributed by the following URL.

Remove clash of clans for pc setup.exe - Powered by Reason Core Security