home

download.exe

Alexey Kurilenko

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application download.exe by Alexey Kurilenko has been detected as adware by 26 anti-malware scanners. This is a setup program which is used to install the application. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.
Publisher:
Alexey Kurilenko  (signed and verified)

MD5:
0063edeb02d8768b3b3aea193343961e

SHA-1:
880b6696540ec21824d198b55c145903d6f83629

SHA-256:
13ca6eb5c5fbe17b45a6ed50c571d4fcf33f17528c97c2ba2c326fb2df7109b6

Scanner detections:
26 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
11/23/2024 5:30:54 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.481287
6339179

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.03.28

avast!
Win32:Agent-AUVV [Trj]
150320-0

AVG
Adware Generic_r.VD
2014.0.4311

Bitdefender
Gen:Variant.Adware.Kazy.481287
1.0.20.430

Comodo Security
Application.Win32.Multiplug.CT
21556

Dr.Web
Trojan.Crossrider1.22966
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.481287
9.0.0.4799

ESET NOD32
Win32/AdWare.MultiPlug.CT application
7.0.302.0

Fortinet FortiGate
Adware/MultiPlug
3/27/2015

F-Prot
W32/S-a45e7af1
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Kazy
5.13.68

G Data
Gen:Variant.Adware.Kazy.481287
15.3.25

K7 AntiVirus
Unwanted-Program
13.202.15402

Kaspersky
not-a-virus:AdWare.Win32.MultiPlug
15.0.0.543

Malwarebytes
PUP.Optional.MultiPlug
v2015.03.27.09

McAfee
Program.MultiPlug-FRO
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Kazy.481287
16.0.0.258

NANO AntiVirus
Riskware.Win32.MultiPlug.dfjscb
0.30.8.659

Norman
Gen:Variant.Adware.Kazy.481287
03.12.2014 13:20:04

Panda Antivirus
PUP/TSUploader
15.03.27.09

Reason Heuristics
PUP.WebPick
15.3.27.8

Sophos
MultiPlug
4.98

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

VIPRE Antivirus
Threat.4786450
38552

Zillya! Antivirus
Adware.MultiPlug.Win32.74645
2.0.0.2118

File size:
882.9 KB (904,056 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\download.exe

Digital Signature
Signed by:
Alexey Kurilenko

Authority:
Unizeto Technologies S.A.

Valid from:
6/17/2014 2:20:17 PM

Valid to:
6/17/2015 2:20:17 PM

Subject:
E=Alexey.kurilenko@hotmail.com, CN=Alexey Kurilenko, O=Alexey Kurilenko, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
15D51642691B3EE20985639A8FE865DD

File PE Metadata
Compilation timestamp:
7/20/2013 9:14:01 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:Mo7fDeTjGTJHMkPko3wee8cwXxpdiHLBEAu:R7fDenPykUeChpdiB3u

Entry address:
0x3EFF6

Entry point:
E8, 78, 48, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, D5, 44, 00, E8, E4, 0F, 00, 00, E8, 45, 4A, 00, 00, 0F, B7, F0, 6A, 02, E8, 0B, 48, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D6, 08, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
284.5 KB (291,328 bytes)

The file download.exe has been seen being distributed by the following 2 URLs.

http://bestorms.info/2ba676d00f0249dac5ebc7ce08fd84b4/all_in/dl.php?id=1415301608680017422&r=http://bestorican.net/v2720/lp/?q=4p laLi421GMe xztvgAxj8SZlRnXytSCmTVMDjYxEtVjGFP5tdtvdMBlPPMTCUdH6rFtpGPpIe3Y5Reyr JegiFpXCUDKE/.../J3pqhGYG&__rnd=ac601687c24deae4a3cd7c46c396331c

http://bestorms.info/2ba676d00f0249dac5ebc7ce08fd84b4/all_in/dl.php?id=1415301608680017422&r=http://bestorican.net/v2720/lp/?q=4p laLi421GMe xztvgAxj8SZlRnXytSCmTVMDjYxEtVjGFP5tdtvdMBlPPMTCUdH6rFtpGPpIe3Y5Reyr JegiFpXCUDKE/.../J3pqhGYG&__rnd=ac601687c24deae4a3cd7c46c396331c

Remove download.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.