home

driver_updater.exe

Plugin Update S.L.

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application driver_updater.exe by Plugin Update S.L has been detected as adware by 29 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. The file has been seen being downloaded from b6axtfucu3e.st31g1duz2.com and multiple other hosts.
Publisher:
Plugin Update S.L.  (signed and verified)

MD5:
f764fd86e1c54ac7ff4f20b23ec33fca

SHA-1:
4c11a42a958a37bd1cabb3ec30ab0b3ce8f1c5b3

SHA-256:
1e470ea4c00921098e3c9c2236cca4b8add628871dbc115105fdd148e59b67f5

Scanner detections:
29 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 8:25:34 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.SoftPulse
2015.02.03

Avira AntiVirus
APPL/Softpulse.aone
7.11.206.130

avast!
Win32:SoftPulse-DJ [PUP]
150129-1

AVG
Generic
2016.0.3210

Bitdefender
Gen:Variant.Symmi.50096
1.0.20.165

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.MultiPlug-31138
0.98/20018

Comodo Security
Application.Win32.SoftPulse.D
20937

Dr.Web
Adware.SoftPules.3
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Symmi.50096
9.0.0.4799

ESET NOD32
Win32/SoftPulse.S potentially unwanted application
7.0.302.0

Fortinet FortiGate
Adware/SoftPulse
2/2/2015

F-Prot
W32/A-7f29bf3d
v6.4.7.1.166

F-Secure
Gen:Variant.Symmi.50096
5.13.68

G Data
Gen:Variant.Symmi.50096
15.2.25

K7 AntiVirus
Trojan
13.193.14835

Kaspersky
not-a-virus:AdWare.Win32.SoftPulse
15.0.0.543

Malwarebytes
PUP.Optional.DomaIQ
v2015.02.02.12

McAfee
SoftPulse
5600.6866

MicroWorld eScan
Gen:Variant.Symmi.50096
16.0.0.99

NANO AntiVirus
Trojan.Win32.DriverUpd.dipney
0.30.0.65070

nProtect
Trojan-Clicker/W32.SoftPulse.750536
15.01.30.01

Panda Antivirus
Generic Suspicious
15.02.02.12

Quick Heal
TrojanDwnldr.DriverUpd.A.mue
2.15.14.00

Reason Heuristics
PUP.Softpulse
15.2.2.12

Sophos
PUA 'SoftPulse' (of type Adware)
5.10

Vba32 AntiVirus
AdWare.SoftPulse
3.12.26.3

VIPRE Antivirus
Threat.4150696
36666

File size:
732.9 KB (750,536 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler

Common path:
C:\users\{user}\downloads\driver_updater.exe

Digital Signature
Signed by:
Plugin Update S.L.

Authority:
VeriSign, Inc.

Valid from:
10/7/2014 7:00:00 PM

Valid to:
10/8/2015 6:59:59 PM

Subject:
CN=Plugin Update S.L., O=Plugin Update S.L., L=Guia de Isora, S=Santa Cruz de Tenerife, C=ES

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0E923B9CF60DA59FC3A43A87A8071FC2

File PE Metadata
Compilation timestamp:
11/11/2014 9:25:59 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:/3R777gDZx2v7/zB+Dyoozgla3t+6kQcTD5Um1jvXDwKzhDZI84HsTTYOoSTsRD:/3RncivjzHoozgXBZUETTwK6Z

Entry address:
0xF47A0

Entry point:
60, BE, 00, 80, 44, 00, 8D, BE, 00, 90, FB, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 7B, 28, 0F, 00, 57, 83, C3, 04, 53, 68, 9C, C7, 0A, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Entropy:
7.9667  (probably packed)

Code size:
696 KB (712,704 bytes)

The file driver_updater.exe has been seen being distributed by the following 4 URLs.

http://b6axtfucu3e.st31g1duz2.com/4ujpespJeQn9L70YMzxWd0BVRHNVntz7kOFe9Qf5Z4rZUb2KslmOJMz-p9oQRkLBV5XnSKSsjm-vmxxY3ozlPvocJH-smm9GReN1i-k0PKs?sbb=['MPU0DlbeXyf79MQHk1rEYzMAmFnAD7HYOnfkiGgyGfVa0v4WlivdZ1R3EIwnw9rJMJiX57U546Ifon5S5ycHJEyySS7HVlbYT0yRbnNCIVjDbeQDGjEzrMs3W7LqNNsN6tLX7wcKJuDJXy0qbrNUwEOy321l7DEYXRbXzDn4JfvLzbgWMNejjtB51Z5vgfDWTNMsXY8aIIDc35YHFgzpYzgYrHnOZkxjOtmUUNme9D8izPUDqnqM9mbLM0LLCSkIlT9VlEDukA9VqaeyVaTME66dnIQ8Urcj8DoJsnPpowDuZvRBiOZHk1Py9jIGLmcKUUndCFKNCj22EA9jCzv8nO396dWCVK0R7Me670dLUjXT4ExuoQxTDZl5NpMIe4U4UHfVVuEKnb5kRd1Ksojz1nPVatymZWe7NXMNwBsdQwl22rkShkfhGXNEVtwFLluHHvV0yUrWVn4H0BlngwVERhMWy0nLKnPxhgjf9WAhPFkF2qfKzoRknkwUIzzwLXnJSaHU2aJrEpCmvbgGHGGxOQsiZjA3UHsQIvTBJuLX9GaccRw1PWoKFXVOFVj9La6RWzJy2FTfoS6TFy14qn7KVzOiOxfkuAcQOeqS9J8HmLdkyc2LInhKmyenjNLKCwbrW8X2Gr4YfUFPi1fjmtLh3aNRPIdMowZU3YXH2q849T0H1Z14zPHpZiEb0vjJ0cAJ14972AkQLWhuFuMRfhwivj2UBZGYvUW0cE4wDnwTf9GaqgYZaFHFyqYS8efpirzg71E0HdHGyHI6KeGU5coT2wV5mnrtaub0XMoNQYCb7JGLRVfTJ4QZUQXQMrEmgCKDG9UOI4cptsJsVTun

http://b6axtfucu3e.st31g1duz2.com/4ujpespJeQn9L70YMzxWd0BVRHNVntz7kOFe9Qf5Z4rZUb2KslmOJMz-p9oQRkLBV5XnSKSsjm-vmxxY3ozlPvocJH-smm9GReN1i-k0PKs?sbb=MPU0DlbeXyf79MQHk1rEYzMAmFnAD7HYOnfkiGgyGfVa0v4WlivdZ1R3EIwnw9rJMJiX57U546Ifon5S5ycHJEyySS7HVlbYT0yRbnNCIVjDbeQDGjEzrMs3W7LqNNsN6tLX7wcKJuDJXy0qbrNUwEOy321l7DEYXRbXzDn4JfvLzbgWMNejjtB51Z5vgfDWTNMsXY8aIIDc35YHFgzpYzgYrHnOZkxjOtmUUNme9D8izPUDqnqM9mbLM0LLCSkIlT9VlEDukA9VqaeyVaTME66dnIQ8Urcj8DoJsnPpowDuZvRBiOZHk1Py9jIGLmcKUUndCFKNCj22EA9jCzv8nO396dWCVK0R7Me670dLUjXT4ExuoQxTDZl5NpMIe4U4UHfVVuEKnb5kRd1Ksojz1nPVatymZWe7NXMNwBsdQwl22rkShkfhGXNEVtwFLluHHvV0yUrWVn4H0BlngwVERhMWy0nLKnPxhgjf9WAhPFkF2qfKzoRknkwUIzzwLXnJSaHU2aJrEpCmvbgGHGGxOQsiZjA3UHsQIvTBJuLX9GaccRw1PWoKFXVOFVj9La6RWzJy2FTfoS6TFy14qn7KVzOiOxfkuAcQOeqS9J8HmLdkyc2LInhKmyenjNLKCwbrW8X2Gr4YfUFPi1fjmtLh3aNRPIdMowZU3YXH2q849T0H1Z14zPHpZiEb0vjJ0cAJ14972AkQLWhuFuMRfhwivj2UBZGYvUW0cE4wDnwTf9GaqgYZaFHFyqYS8efpirzg71E0HdHGyHI6KeGU5coT2wV5mnrtaub0XMoNQYCb7JGLRVfTJ4QZUQXQMrEmgCKDG9UOI4cptsJsVTunL8736C

http://ttb.softpcdll.com/download/request/.../ey8pIpfk?PubID=79_3527_3100&ClickID=8038723304

http://www.kongyunbao.com/down/Intel/.../down.php?sid=726&dv1=ad719-us&kw1=ad719-us-xx&uuid=9badf810-d72e-4eb1-7ff1-050bc207eb99&dv3=9badf810-d72e-4eb1-7ff1-050bc207eb99

Remove driver_updater.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.