home

dulux visualizer in for pc.exe

Stepan Rybin

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application dulux visualizer in for pc.exe by Stepan Rybin has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from epictory.net.
Publisher:
Stepan Rybin  (signed and verified)

MD5:
6b086a9205ba92688d384e47cee35a45

SHA-1:
e770c9eec59bc118539d181784831b05d7b97d85

SHA-256:
8cf5cc79fae4292d64ac7ae3f4ae487e9a5f54f673f85904f358eaf11e69bcb6

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
1/14/2025 10:46:05 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick (M)
16.7.25.9

File size:
1.1 MB (1,155,784 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\dulux visualizer in for pc.exe

Digital Signature
Signed by:
Stepan Rybin

Authority:
Unizeto Technologies S.A.

Valid from:
6/27/2014 2:07:40 PM

Valid to:
6/27/2015 2:07:40 PM

Subject:
E=rybin.step@yandex.ru, CN=Stepan Rybin, O=Stepan Rybin, C=UA

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
47154C2151E9EB8DFA42C2C9E45BFC6C

File PE Metadata
Compilation timestamp:
9/10/2013 11:52:43 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:8oMnqINxN3Y5NvmBs4CYxkfZ0vDJYMyLRC3RyPsY4R:8oHonY5YB7dkB5vNKRyPYR

Entry address:
0x1E40C

Entry point:
E8, 8B, 36, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 90, F5, 45, 00, E8, BE, 0E, 00, 00, E8, 58, 38, 00, 00, 0F, B7, F0, 6A, 02, E8, 1E, 36, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 2B, 07, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.4069

Code size:
357.5 KB (366,080 bytes)

The file dulux visualizer in for pc.exe has been seen being distributed by the following URL.

http://epictory.net/hp/?q=B0g8/vxgVf1hg45678U4YW21OdSODi/B9l/1JE8nlW9 5y9tSfh0r rboYieBLUvo0uL1hlWRamJM0pVlXHxt hnUp6g6vgLfzAJssxKpE3nq8i1R2n39ednTV ajR6CRYGlPrAJUcJwdwQJT7Oy3cshBL51LiSaopsx0PUvAhpW1ctVyQxLuJOFYiJ qnXHIc0tDVePrXwjKNDC0G37bhy1HdNLJEpMnnnytdutSf1J8BMqSlHGMGcb17Xf2Ia8pFILZdok9r5OF6n0knLN3ZFDUfjvdFLkwmjUI6ECxX/rqQ3Z1 8FLo19QbiTi5T4UbZsKisYDonwCh D6gm18onlky2bRsZzgHSBH7lcRFEhxNQOHc7X0XrqGhtKIAerL2wGo1i5EgiSlVbZfuZeQAZ8p13fTAukLA8ywMx 9ZxvTkznmIJFTb9bSZ8nRkPU9f/7lerLaITXosGTD0FsjLOyxXrJ4FpHP1ljzUEUejCJxEIYTjpl42gG0FLhYOstKTTnTWzYGbN6dqI79jaC8okPRGuwNqgxpelTAM/6nZ dvlI bmeDpGknXRTualV6wyjxzjs8Uu1KHdjxn7Uh9tOsxHFFG33NNAVLnXv9i6LNWnEISqtPOlM8YSuFLb3ZwnjtnSHXxBxKNDeYXtevwG71Mv1Lo9mHJN9v 9E2XvyFKk83k5vnds5ayb8TnFVAutMX9u2p/jxWHITinY6X842aQfDjo5A5SmP6CdOf8PriLuYtn5/pvYi/m TBwdJsh/7y1Q8x/1vF4NgZ6E4QhNXBW/umNgf30ssgB5/.../QRE9YU5R2rFKQQ&external_id=1422880669012000510

Remove dulux visualizer in for pc.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.