home

diskcleanerfree.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application diskcleanerfree.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftbundlesfactory.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
8da3bfb2d477a2574959f41a11b16d45

SHA-1:
510e78ae2c06e126e255c42a355e6af1f2ad83c5

SHA-256:
d6e6d0bfb08efc715dc452bb9562d23c8ae066420b986bd0a5c23fdc10f2e14e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:28:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.7.3.11

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 5:00:00 AM

Valid to:
3/25/2017 4:59:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Uti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:UEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9345

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file diskcleanerfree.exe has been seen being distributed by the following 5 URLs.

http://www.giftbundlesfactory.com/350y3QMFoJTcCj32rKo1dau3_woiZ8dX8Ov6Mk4hI6Qey5NHMcMb 24v0vRqYt_5QAesqQ6M2oyF8EzY0QeSifK51LWA_g9482t lRG05gHxurYmyuelctWXXb5rH4NTgGS8det 3WanJD6fP86DEz2ft5htdVG19qAL5m2GbmFmgUE07ZbE5j5IH7mMO Aq7QUts0dChGjUqPFvICw0uLyOvc75Gw==-G1AAAATEbTH9L EimKUbZOEIF27RKQfstZIAw0APQPcYO08K8miNYb7JdjO2JjQt8ipoUnFSt6HHWrzjiK8XrDGVDw==

http://www.factorycapitalstock.com/ZgSgnxVsgq6H47zJ4GC3nALKKaQ9SMk8bG00aI05XLNGAfz7o1aWxmGaZDTHlJLpUOrmWVyRWJNshyGsrbkpnyfhWXM8850Me_O6qDqVQMKpaPbvRxXCnS1Qg2EMHLnXiN pAEru7Z209BJSrqA2_KWYJVgkbxH5_gkweFXCnfXA1HtZE60bVRs5Sx2Ef8n37B75jBGH9SmCpMJdELgj3YnVLmW16w==-G1AAAATEbTH9L EimKUbZOEIF27RKQfstZIAw0APQPcYO08K8miNYb7JdjO2JjQt8ipoUnFSt6HHWrzjiK8XrDGVDw==

http://www.factorycapitalstock.com/CW0VWxkPyDgjllb35cXrMuSkZOqDDmDBR7mJCsjB X11xRiYxQPk4aNv3J1HWPGG3gTz6hgODG6EB1AHHiVUSROCWAYhT PU6UKO6I5GVrsWf9awaI0WT uJpKsAEiaE6o9mFQL7osZ3XbJ814R7ZmwCIjuxlWug202KSMNEQeNbXrf2c6MTxNRVogh0pP1eW9kExir4Pyx98ASbkqZQxCnPAz7H1bmA51nDGcbBEx4XgZAKzowbbJyK8LrENK adESA1ZfKrTITvy4yFwRw15pbPUKDMhbSwpWo0YGeTKaqFeHgTQWEiIswyqbyyOBRsvnfA_XLDoxe Ifu5lc_3jRnz8XRJxP9vQivg2jzax 4VMF6eqol7BFz9q4u8_fH1q8GD3KYFjeaoiRXhvGh1JzU0qX WgmSqYYnsL2hNAcDCTvIDNU7ZaD9cBehrMCV7o4Zm45F3eqTikeYrQ7II1QyeAFeMw==-G1AAAATEbTH9L EimKUbZOEIF27RKQfstZIAw0APQPcYO08K8miNYb7JdjO2JjQt8ipoUnFSt6HHWrzjiK8XrDGVDw==-e

http://www.funtourbundle.com/c86MHnZ3BzYeQAnZRxw9XIHbX8LlYt8JujFSBDRv6PfjTKcV87UAn1eRSb hIWB4m ahhDvbminuhTUhn0_Xlzr12Um1GPmLFe_emAlQp_lNV5jyHJN7F 0_yoah_VPb3BbSvdElAMzmd5MQ16YoX qzZcEOhnVISz0adPz4LvTBXhJla2xb1ctDPLMfsyKSnVNMX 3VP9B1wbMe113cRSZ1cBxeQsIvVZoCN4ySTt PJQBmCw2YPBPh97EyCUWDKWpjwApcnIs966_6nEaUM1C Evvr1xE4kRa7Icna_sFqSaWVtePhA7bI2sorl_T3tz5 Tw5l tGbTcv6ppO8V4un_zZuKt9PHuY2A06sArgA29Vtd_pG OjiDfmMPoIYSMk9m2BVglVeT9ainSGrqhk6S9ozpcXK5BA Kl9B_ dvJtpDOV176HuNsRKoHZF8I2kqvdPjFXoJNHE UdL9nqt85Ydjdg==-G1AAAATEbTH9L EimKUbZOEIF27RKQfstZIAw0APQPcYO08K8miNYb7JdjO2JjQt8ipoUnFSt6HHWrzjiK8XrDGVDw==-e

http://www.taggiftflash.com/Fy0oKYqNJbpk9gZqc9UdDCtTrvPG9B81gRzyJQWGTMkBnIVO4DpLPlLXunKzb13XVFHTINHnR3Sw7u46p2YKAm0cLViPpbZIIruHYz_rPBEmNM9ZJtgR9vQ1Eh4I3iyC5a5GxzCTkNCB317moSZfzCPI0_36z8Lj8vpbKj4vqOe6 DhAjrn6yOvLthIKJ4ueH0Y68Znbq_szGRSgaShqZZJvKsdyOmyFVJHyf94vCJRhI0ZFKmnqtISx7m GIgMkwZvQCjavIpv65Aww3MqjKC3nWYEyEz7E31aMTlwbMXO6N e2y2Plmds5MJ8ai46Qo2JWh ftBMDrYX3qzOkpE5RfMaKqD3Oq60Ca4SQmvSgwzbeaqvUqM3l8KEyuYOrO1 P A0 1Q6kLNLg DnrlsB8PSs1aBSQM5Z_Gb FdQ6X b7Rn7FZZ_65CLVA4wM_rxzqfjOnuENeukoiDd_pArvpizwRToQ==-G1AAAATEbTH9L EimKUbZOEIF27RKQfstZIAw0APQPcYO08K8miNYb7JdjO2JjQt8ipoUnFSt6HHWrzjiK8XrDGVDw==-e

Remove diskcleanerfree.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.