downloader.exe

iPumper

Escolade Solutions LTD.

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application downloader.exe by Escolade Solutions has been detected as adware by 3 anti-malware scanners. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from www.anyfiledownloader.com. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Escolade Solutions LTD.  (signed and verified)

Product:
iPumper

Version:
1,0,1,448

MD5:
3d6c23b6d35590df9d1de10ab98d8056

SHA-1:
ff7412630be0aa52a69a31e26dbfc8f4568f1f26

SHA-256:
2dc3690e279fde423c6c475204d93864aaa68dd4de10c792d0776293d9a12590

Scanner detections:
3 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup. Distributed through the Brightcircle investments brand.

Analysis date:
12/25/2024 1:43:18 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.889
9.0.1.0199

ESET NOD32
Win32/BundleInstaller (variant)
7.8118

Reason Heuristics
PUP.EscoladeSolutions.K
14.8.8.0

File size:
2.9 MB (3,092,936 bytes)

Product version:
1,0,1,448

Copyright:
Copyright 2012

Original file name:
iPumper.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\downloader.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
9/24/2012 8:00:00 PM

Valid to:
9/25/2013 7:59:59 PM

Subject:
CN=Escolade Solutions LTD., O=Escolade Solutions LTD., STREET=Akademica Vernadskogo blvd. 36-507, L=Kiev, S=Kiev, PostalCode=03451, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0FB283CB6EEA8D0204BFA51C4BCE925C

File PE Metadata
Compilation timestamp:
3/12/2013 7:24:10 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0x2936C

Code size:
222.5 KB (227,840 bytes)

The file downloader.exe has been seen being distributed by the following URL.

Remove downloader.exe - Powered by Reason Core Security