home

codec-pack_installer.exe

Pulakabot

InstallSpeedy (New Media Holdings Ltd.)

The application codec-pack_installer.exe, “Pulakabot Setup ” by InstallSpeedy (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.capitalcenterdl.com and multiple other hosts.
Publisher:
Mapune   (signed by InstallSpeedy (New Media Holdings Ltd.))

Product:
Pulakabot

Description:
Pulakabot Setup

Version:
5.3.3.8

MD5:
17e589cdbd3fffeee819e560818f2598

SHA-1:
e7632afd8bcdd99b1d3a711da65b0653dcf9e5ec

SHA-256:
262a594f38943cb6c6426e9b029376895c008b9097ce42d327fa159d775fe561

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/27/2024 4:48:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.26.18

File size:
942.6 KB (965,224 bytes)

Product version:
4.6.2

Copyright:
File Wizard

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\codec-pack_installer.exe

Digital Signature
Signed by:
InstallSpeedy (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 1:40:35 PM

Valid to:
7/11/2017 11:28:33 AM

Subject:
CN=InstallSpeedy (New Media Holdings Ltd.), O=InstallSpeedy (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121F59EA8A6B04CAE5E738F6CB09D295BDB

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:97Olet11LF4R3xeOVD+GSJaFhSWXJQuBIA2rsgTJO+vzmzIEqJ:97yE1b4DeOMjuhDJpBIlrsgTQPUE

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file codec-pack_installer.exe has been seen being distributed by the following 12 URLs.

http://www.capitalcenterdl.com/c?x=4wUeJzDMid4eMyukUXhfdOV1oIlrv54292OowbUROTs=&c=RhsEYGNprLz4QQXinZRCtuAVZ2ywKAik9hZUJOftOehKLgN5jxs7Xig0tTHX5ux9X7HlcAzXhAFN1Ydg1bxUGM8l2XPtbKG0xkqzYwbE6buDBl85rcYkv1msAK45QfVK&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=KbxK2ngdqy0q96G2rJQekrCbfX6I5U4/rZR2SbXUmuI=&c=3D5L7vHG caaSuQH4 ZrvO PL9BMLLKsn3SfN5bNm0SGlHi2oxvXLbfioFPV3Ctf/NAID7TUodfxT0aAMtZ5GXB43fDC4tp/6DuQqqzE9VApk6NV0 xx2iWcB9r06I3a&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=2Rda/sVHAZEEf3Wv2zRUK/A3M5ChsshVTqgWCnZ0apg=&c=rtFf4YLXEZjR0BjFZMzuLtD2qww4HaLyW0Qpy9CSCH292qyUD17GYDYnDnWDfZ98aWT5 6fVXUOPgBkNh0CFZuZNWA98f H/OujozRNoL8O7Kz4ytq8jkZRPl4jdMYOw&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=pKqLyCcrdhzjhH4UMna brtUzWoEbtWl7fV1HeOvEjI=&c=/jdM6Io7zGTkbLSbTrLyu kwYti qtzaTg vSdTlB87ftNMpi373WMZ/km vTovROZYV53 S7kNRi4edl9jG68 mXLky3tBji2oDct2nNHyvfrhXhLezKNkDWr8RaktD&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=9Hk/GOOi8s G6cF2T6n/ 5rqvNmC1bJSzONZGctsWAI=&c=GKscwoJMz57WbD6Su6 wGstgnZM1oyqJd9UZY3H2si XsKTFj4JVB6OcAYOctp2OIj7EPtIaYixjXNzNgOEpxUkGi0FGZoHGAVkEjVop676MgKsRefdU/6angiZLcXxL&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=jn3DS6B/07 I34ZZOJj5JhBAJqqrcf9Q0am0jpclSyU=&c=dVNWCKSRPaVddxuqhskcilo0TmxP91bLR3MA7cKqhdsyxjPM U8qx3VR8InL2 06V5RnGqdSNz7e2 dyxj5vrpNcX9o2e27UDO1psimf5wILn6OurPC8xi8muOXJffko&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=R/6hSpxJLKkt jyYLKHJ4RCCR/wDZIi16wmq2D6FdXU=&c=PEDsDiS5mD5qgg29CouUx1z5JjFbo3Zj3XQqFzNehu4VyWg6jNJR5Sxi7MrWE82E5NyWDT1edGc8DczeINnwVY1CBm8bdSZMAQdOonkc4vq0BT9ypPbcIN EDQtldIJP&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=mfSJ6EYrD2xKFzpvACWGnw9csyo0v0lIckkytw9eM/4=&c=J8q9sQYZrdK EDVLMU1ZJEX8ziRrytiwaju3UJtZ dZA9oj96fwDwZLQWSQzsi02yKMfHEq0/kLCEkwvqCBMV9PNUxLL9mThKZAkuxcWTDUJ5wb9m6tOnNPeteZUwga5&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=1ImivKH9TrfpBaKo18gjvPd3QdA/RYGIlLgl3Qnu2/0=&c=vieDi /61LooCsorXOYlwMxfS43B4Si8eTzayz7i/fQeKLek1FK8jW5TAsppU5PjsS /JRbkgexaaQv3Jtt2UFtqyBjcvluW3whEIVhnlTKDH7nCcMQMHJyq8RgsDoXC&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=/ngoKvMywrSnJTLITeSddZ6CaBl0rITJ7OZSsyZshY0=&c=RaAU0wEOz5rl6Lt98kbfL4iULQiVA4Lrivzah7RabwgoJ4fi/5BPdcQ2kFteZGLv6D1FgeHMxqq5Szm59JAES3lq6oK4BNJ9p Js5skOA7B1v44V8J9svr6S0gYpseJv&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=S GkrIEWzZn9vH1EFeH5baJ8crIspdHVxrUe0F1Plnw=&c=x3b8ASpScwVyOmBjOu0TIKKU2Bei51TvFRoFhim0R JXAo/ O5LRoAHzPXs9vUOs/S0LY5AsVnEvzSfoFgPGCxnbkAdfTdxgkcfF63lXC7BXwSCog NuLPE4WLTkCqkf&downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

http://www.capitalcenterdl.com/c?x=ArM5KTzWwk4jiLcjfmqY99hMF qtqvyBoHGtIRg6k 4=&c=y9dBJAlLoODlyIFGehG8U5LscCx0IWzVC956SJxOITJlhrimF4AIFjg7V1gtgndSeKn60Tkfd6j9Xu5YHtyJV079QQKfitNxrJvhwuVf1XTvrvNk2nEkVLHaLZX3jZH &downloadAs=Codec-Pack_installer.exe&fallback_url=http://codecking.com/downloads/.../Codec-Pack_installer.exe

Remove codec-pack_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.