Malware scan of epubreader_setup.exe (Fep ) 23f8a2a263c89aba50a44f1ff3a406ba49a6dd74

File name:

epubreader_setup.exe

Publisher:

Hot

Product:

Fep

Description:

Fep Setup

Version:

2.0.2.7

MD5:

ad2595f7fc71508df676acb0622ba9c3

SHA-1:

23f8a2a263c89aba50a44f1ff3a406ba49a6dd74

SHA-256:

e53c28a84ff5589a58f13fc2a65a98710c2a3f02f67042df0832ecffb13d521a

Scanner detections:

2 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/15/2024 12:48:45 PM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/InstallCore.ACY.gen potentially unwanted application

8.0.319.0

Reason Heuristics

PUP.InstallCore.EST (M)

16.3.7.15

File size:

1 MB (1,096,886 bytes)

Product version:

3.2

Copyright:

web

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Compilation timestamp:

6/19/1992 7:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:vlqDXK2qW8Rqx1yviG7o9EVttoyNbvpVER5AAebt5AYzo:vUbH+k1aiP9EVPBv4ALXAYs

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file epubreader_setup.exe has been seen being distributed by the following 7 URLs.

http://in4p.com/red/out.php?to=http://.../?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP+Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG+HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx+vWp43WFkmNH6mo60Oc6v/Vib2W6S+VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF+pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI+9YO15xyE7OkN5Vl+DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn+p7sdZcWwjqcB+diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr+FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/at0BB73UR7zCPB2zK6JQVE/ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFM

http://in4p.com/red/out.php?to=http://cdn.rsparkcontent.com/?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx vWp43WFkmNH6mo60Oc6v/Vib2W6S VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI 9YO15xyE7OkN5Vl DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn p7sdZcWwjqcB diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/.../ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFM

http://cdn.rsparkcontent.com/?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx vWp43WFkmNH6mo60Oc6v/Vib2W6S VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI 9YO15xyE7OkN5Vl DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn p7sdZcWwjqcB diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/.../ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFMEPFVG95SKvQ==&ic_user_id=225&js_version=0.1&fallback_url=fallback_url&downloa