download.exe

Moshe Karaso

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions using the JustPlug.it browser framework. The application download.exe, “Installer for SoftSafe” by Moshe Karaso has been detected as adware by 37 anti-malware scanners. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The setup program uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme.
Publisher:
SoftSafe  (signed by Moshe Karaso)

Product:
SoftSafe

Description:
Installer for SoftSafe

Version:
2013.3.7.1726

MD5:
aaf578e759b9e00f0c56f3fde2036e16

SHA-1:
9af675503f689180a3f990b3ffb359732f21807e

SHA-256:
7dd4bd786cb08c69e22be3969dc6455b3ed8b1bcccf4ecaed9df71a317e23e6a

Scanner detections:
37 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
11/4/2024 5:10:39 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.InstallRex.2
5913030

Agnitum Outpost
Trojan.XPACK
7.1.1

AhnLab V3 Security
Adware/Win32.StartPage
15.05.05

Avira AntiVirus
ADWARE/InstallRex.Gen
7.11.145.74

avast!
Win32:Downloader-TRK [Adw]
2014.9-150505

AVG
MalSign.Skodna.Bundle
2016.0.3119

Bitdefender
Trojan.Generic.10010889
1.0.20.625

Bkav FE
HW32.CDB
1.3.0.4959

Clam AntiVirus
Win.Adware.404217
0.98/19185

Comodo Security
Application.Win32.InstalleRex.KG
18166

Dr.Web
Adware.Downware.980
9.0.1.0125

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.InstallRex
9.0.0.4799

ESET NOD32
Win32/InstalleRex
9.9559

Fortinet FortiGate
Riskware/InstalleRex
5/5/2015

F-Prot
W32/InstallRex.B
4.6.5.141

F-Secure
Riskware.Gen:Variant.Application.Bundler
5.13.68

G Data
Trojan.Generic.10010889
15.5.24

herdProtect (fuzzy)
2015.8.3.13

IKARUS anti.virus
PUP.InstallRex
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.176.11888

Kaspersky
not-a-virus:HEUR:Downloader.Win32.AdLoad
14.0.0.2088

Malwarebytes
PUP.Optional.InstallerEx
v2015.05.05.08

McAfee
Trojan.Artemis!EA9C80D2EDED
5600.6775

MicroWorld eScan
Trojan.Generic.10010889
16.0.0.375

NANO AntiVirus
Riskware.Win32.Downware.crunuw
0.28.0.58491

Norman
Trojan.Generic.10010889
11.20150505

nProtect
Trojan.Generic.10010889
14.04.25.01

Panda Antivirus
PUP/TSUploader
15.05.05.08

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Quick Heal
Trojan.AntiFW.B5
5.15.14.00

Reason Heuristics
Adware.WebPick.Installer
15.5.5.4

Rising Antivirus
PE:PUF.InstallRex!1.9E4C
23.00.65.15503

Sophos
PUA 'InstallRex'
5.13

SUPERAntiSpyware
Adware.InstalleRex/Variant
9894

Vba32 AntiVirus
Downloader.AdLoad
3.12.26.0

VIPRE Antivirus
Installerex/WebPick
27526

Zillya! Antivirus
Adware.Agent.Win32.8456
2.0.0.1789

File size:
281.1 KB (287,888 bytes)

Product version:
1.0

Copyright:
Copyright © 2012 SoftSafe

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\download.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
11/15/2012 12:00:00 AM

Valid to:
11/15/2013 11:59:59 PM

Subject:
CN=Moshe Karaso, O=Moshe Karaso, STREET=Nahum 19, L=Ramat Gan, S=center, PostalCode=52233, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
55036D3C9B5C690240A409061736347F

File PE Metadata
Compilation timestamp:
2/4/2013 9:49:08 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:xr+AI5RxWBDg7V0eXze6OvA48oN3bWkKeJmirEDvPnWuuBj2Py/RraQtO:xr+AI3sBDJejgPpbbmir4WVx2KO

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9544

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file download.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

TCP (HTTP):
Connects to c1.stylezip.info  (54.186.255.26:80)

 
http://c1.stylezip.info/?step_id=1&installer_id=21131506&publisher_id=113&source_id=0&page_id=0&country_code=US&locale=US&browser_id=4&download_id=63394518&external_id=0&session_id=126789036&hardware_id=147920542&installer_file_name=download

Remove download.exe - Powered by Reason Core Security