home

driverrestoreupdatetool_537abb3d522ae1d5dc6c39c43523c5b9_en.exe

DriverUpdateTool

1NSTALL (383 MEDIA, INC.)

The application driverrestoreupdatetool_537abb3d522ae1d5dc6c39c43523c5b9_en.exe by 1NSTALL (383 MEDIA, INC.) has been detected as a potentially unwanted program by 2 anti-malware scanners. The file has been seen being downloaded from email.securewebpayments.com and multiple other hosts.
Publisher:
Microsoft  (signed by 1NSTALL (383 MEDIA, INC.))

Product:
DriverUpdateTool

Version:
1.0.0.0

MD5:
52b75973a2c8674ff1a79b9be0ab4318

SHA-1:
b6171da7ce3c9c651d704747d16158c8140854fb

SHA-256:
02ae94b3ddf082fa2b355ee2fb2cefe35fc038612c96ce0d0607c30dbcc8ca3c

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 2:04:31 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Program.Unwanted.90
9.0.1.0239

Reason Heuristics
PUP.Optional.1NSTALL383MEDIAINC.FF
14.8.27.0

File size:
616.1 KB (630,904 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © Microsoft 2014

Original file name:
DRUT.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\driverrestoreupdatetool_537abb3d522ae1d5dc6c39c43523c5b9_en.exe

Digital Signature
Signed by:
1NSTALL (383 MEDIA, INC.)

Authority:
Symantec Corporation

Valid from:
7/30/2013 8:00:00 PM

Valid to:
5/24/2015 7:59:59 PM

Subject:
CN="1NSTALL (383 MEDIA, INC.)", O="1NSTALL (383 MEDIA, INC.)", L=Pleasanton, S=California, C=US, SERIALNUMBER=C3341789, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
059C2A47830CA2BB198B8CCF1DFBBA93

File PE Metadata
Compilation timestamp:
8/14/2014 9:01:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:JjerjeazN7cPyDsi+OEWS0CO/vtZz+4XTk6i3WIw2CBFCTZwbxVSpSr0taqaHwUB:E8oxX572CTCVOxsSQQdQo/as

Entry address:
0x9925E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.4069

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
605 KB (619,520 bytes)

The file driverrestoreupdatetool_537abb3d522ae1d5dc6c39c43523c5b9_en.exe has been seen being distributed by the following 7 URLs.

http://email.securewebpayments.com/.../click?upn=xAo8Lr9GdOMSL1FZUHScYuUUGUoOpVbFbn6z1JqMNWg-2Fu61s2jyvASjT5vLJG9chQUBgInpLfsBqcNyBaHJt9cZcn2V39ENqy4x3ovZH28YW1VQLLL69VJr2n16q6mnP_qZrmeMKT6ZcrVT9HlC5ueobv9hCDQtRwZCT0ACUbgNOyp1M-2Frp-2Ffco4ip87hgIlFaqiLk6lYBhJIQdiZK141-2B4plUF9w-2Fpy7shyTf-2BSwsJwWuUQq83aj3rUrgjpnKIh2hBebc5fBs9cCuzuqchk2BwJVAEwMXc6hK-2FL-2FnT7DbZy6bamE-2BapghMtIMwsTWoG9QXb8z1sjt0NcC03uO9fQyQ-3D-3D

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=fdbfa97ea780aee8844f293710c5c2bc

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=747ed190f6d1d35e53f3062d7f20bb05

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=endr2

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=27d0bc4f0b32d47030c4481bcaf7b6af

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=91548c498829a03cde69f6fd0c7bf077

http://landing.driverrestore.com/download_drut.php?lang=en&orderhash=537abb3d522ae1d5dc6c39c43523c5b9

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.