home

driver_updater.exe

Plugin Update S.L.

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application driver_updater.exe by Plugin Update S.L has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.
Publisher:
Plugin Update S.L.  (signed and verified)

Version:
1.0.0.1

MD5:
0fa57d7b5dd3694e58e24e8c8f27d431

SHA-1:
5957605e55be1d76c9bc6a73e4e3eeed7b6bcb36

SHA-256:
84ed72c886dba1ab18ff4ce14f92e989c71b8f718a4c765f4b57a172eb37c9b0

Scanner detections:
31 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 3:56:25 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.SoftPulse.2
797

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.DomaIQ
2014.12.01

Avira AntiVirus
APPL/Softpulse.Gen
7.11.189.150

avast!
Win32:SoftPulse-AK [PUP]
141119-1

AVG
Generic
2015.0.3275

Bitdefender
Gen:Variant.Application.Bundler.SoftPulse.2
1.0.20.1670

Clam AntiVirus
Win.Trojan.Buzus-20000
0.98/21511

Comodo Security
Application.Win32.SoftPulse.D
20241

Dr.Web
Trojan.DownLoader11.36367
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.SoftPulse
9.0.0.4570

ESET NOD32
Win32/SoftPulse.O potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/DownloaderLMN
11/30/2014

F-Prot
W32/A-6d8b11dc
v6.4.7.1.166

F-Secure
Gen:Variant.Application.Bundler
11.2014-30-11_1

G Data
Gen:Variant.Application.Bundler.SoftPulse
14.11.24

IKARUS anti.virus
Trojan.Win32.Buzus
t3scan.1.8.3.0

K7 AntiVirus
Unwanted-Program
13.186.14174

Kaspersky
not-a-virus:AdWare.Win32.SoftPulse
15.0.0.543

Malwarebytes
PUP.Optional.DomaIQ
v2014.11.30.07

McAfee
SoftPulse
5600.6931

MicroWorld eScan
Gen:Variant.Application.Bundler.SoftPulse.2
15.0.0.1002

NANO AntiVirus
Trojan.Win32.LMN.dgkmmt
0.28.6.63726

nProtect
Trojan/W32.Buzus.1626040
14.11.28.01

Panda Antivirus
Trj/Buzus.BR
14.11.30.07

Reason Heuristics
PUP.PluginUpdateSL.O
14.11.30.6

Sophos
SoftPulse
4.98

Trend Micro House Call
TROJ_GEN.R08NC0PKU14
7.2.334

Trend Micro
TROJ_GEN.R08NC0PKU14
10.465.30

Vba32 AntiVirus
Trojan.Buzus
3.12.26.3

VIPRE Antivirus
Threat.4150696
35224

File size:
1.6 MB (1,626,040 bytes)

Product version:
1.0.0.1

Copyright:
Copyright (C) 2014

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler

Language:
English (United States)

Common path:
C:\users\{user}\downloads\driver_updater.exe

Digital Signature
Signed by:
Plugin Update S.L.

Authority:
VeriSign, Inc.

Valid from:
10/8/2014 1:00:00 AM

Valid to:
10/9/2015 12:59:59 AM

Subject:
CN=Plugin Update S.L., O=Plugin Update S.L., L=Guia de Isora, S=Santa Cruz de Tenerife, C=ES

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0E923B9CF60DA59FC3A43A87A8071FC2

File PE Metadata
Compilation timestamp:
10/9/2014 11:11:04 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:ezD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY3:G6/ye0PIphrp9Zuvjqa0Uido

Entry address:
0x6978

Entry point:
E8, DB, 40, 00, 00, E9, 7F, FE, FF, FF, E9, B4, 26, 00, 00, FF, 35, 20, CD, 4A, 00, FF, 15, DC, 50, 41, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, D2, 38, 00, 00, 6A, 01, 6A, 00, E8, 7C, 47, 00, 00, 83, C4, 0C, E9, 93, 47, 00, 00, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, D3, 47, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, A6, 2B, 00, 00, 59, 85, C0, 74, E6, C9, C3, 6A, 01, 8D, 45, FC, 50, 8D, 4D, F0, C7, 45, FC, C4, 30, 4A, 00, E8, 4D, 2F, 00, 00, 68, 1C, 94, 4A, 00, 8D, 45, F0, 50, C7, 45, F0, BC, 30...
 
[+]

Entropy:
7.4833

Code size:
76.5 KB (78,336 bytes)

The file driver_updater.exe has been seen being distributed by the following URL.

http://lander.vopaa.pw/apx_flash/uk/.../UK DDL Driver Updater.php

Remove driver_updater.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.