» expressfiles.exe
Overview
Analysis
File Details
Downloads (16)

expressfiles.exe

Fifute

UpdateStar GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application expressfiles.exe, “Fifute Setup ” by UpdateStar GmbH has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.presentbitsshare.com and multiple other hosts.

File name:

expressfiles.exe

Publisher:

Doroh (signed by UpdateStar GmbH)

Product:

Fifute

Description:

Fifute Setup

Version:

5.0.3.8

MD5:

b8c335b49c5d508183e8af6a5199e2db

SHA-1:

3e7c9ccf89bd580f19c00c2515abc65c824668b6

SHA-256:

7ee6d9b97e34985b8864f84f193cf33c4db947ad44c89a93020364184a8cd3ab

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/5/2024 2:52:16 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.UpdateSt.Installer (M)

16.6.13.11

File size:

992.4 KB (1,016,232 bytes)

Product version:

3.7.6

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\expressfiles.exe

Digital Signature

Signed by:

UpdateStar GmbH

Authority:

GlobalSign nv-sa

Valid from:

1/8/2016 3:34:15 AM

Valid to:

3/6/2017 4:10:42 AM

Subject:

CN=UpdateStar GmbH, O=UpdateStar GmbH, L=Berlin, S=Berlin, C=DE

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121206405ACDAB5906908B3939BD86EF916

File PE Metadata

Compilation timestamp:

6/19/1992 3:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:NIXgucdX2bMP9RXC40+VQ4VDPCgUdu0lET:G+X2bMF0evVUk0Q

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9236

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file expressfiles.exe has been seen being distributed by the following 16 URLs.

http://www.presentbitsshare.com/c?x=kqEddlLPU tzIMDNA38j8H3/e3DRcR1YnVoQ39Dw/No=&c=G/1Upx2SJFS6UUWarz2q6hwBW bVJnEtUvOqD 55O6BbxlJEeA5b3DdrRnaLgtDo8nyyKG1eYgscz9AToIj980EwJoeVxKLJUTAHQDkvZrhCeQtaJsbodw1/VDi70riSGncXel6VB8NML0bPuWyAC OnNNbhZ0POHzm8JX16Ltk=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=eMJo9E5fsWku600UuNIXFJqwck9MAShSxCfD0y2RscE=&c=u fJ4zZxyo3nQgXOtCYY 5fogATa3jV6EhcFBk3anoKwKewvp9xlFfQp3nL9kYdWdbfb/MezCQZ6uHENxr/kCmdq4cX6nh4EGAGImhHX0syqt41/Iscwv63DAI2P6MR Rbr7 iurU2ftblYAuK27Cw1kstW1UYs8hskISFQiHQw=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=t2P/ k1jkHqPNASc8R7SrI7a9pW6gT8QjTAN170pcX0=&c=v2bzMCTBYpB9PAWAUZQbec9KFr1W7Gi7S4DKvSZWl33J/o/TzygHzrH7iW/2wIdnrkLLyDWvOBcl vkv5RVGgiXk51iIkEy2wJ5N4wejRZ1DGeJJgIRKgWmZpYUrf46CagmEAuKQdJMEo0qF50WbGiRkmJ5mo4EgTsUydXYu8tQ=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=cn7LLloOIewqjQLuzNau1xhNMEXmAarT hdVcYL0bKI=&c=rfEQrQVAZJFDealepLKllt1U24xjOmnQoGueuuCilYqLUutQoekzX4EMGtOe8mf UYRjvvWiA00v8VU FoQTN76u4afF9yWfO8tc2IUpHUF6tBAnX2nb KgLiBLBFBgp&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=aqP67qXvA2pkl8O76cTZopHa5Y5EKH7OeXJeW98vaB4=&c=3SnMQaYoJUi/nDFVdSJy 7il7ANc NyTjn6ieIrVEaZ AYHNUfEYI9E1 0 rIX9ieMrY8zgGlnlonUw8upUnKt3RsRv5FykIohwdudoqMJgkfwcjhCJt9lfQTfBmoKI0&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=X7OCA3W3L8ZBOUG31Zj1ZzI4NgzNec85hZQKkAYvh/g=&c=2bCKCGlFr32hBjiVQfc9abY4bs8HmB9rCqDvYjxyFdyd8ECYgRHx3HJmb x4KgqsoAoqtD00EGO9X/m5J56PedKBsNxhVLmd0myzqGD5OIGr0xg4TdU W9ATWGCmheXXUpBwchXiViHALzw8cFXXTqjmx5L0 1eGNLJLXzvq7J4=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=rlMi2WHIP2IVsHgh7dgT/ay0k05E4M7rooUGgT8fdzA=&c=fjEeqNlkqhSAFb4joYVjhoiE pgJx9eBYitn2ToJhxuntgJ/O6Fvb8fealD8CJcv1lerjL9jgYj/0egK6arjxWJUWV71C50hM/WA HK0YxWph9R0Rb2wj9fRS 79P8OMU2KQfYOOxPOI15StetM1L9ZTq/1FsyzMkztoFRbhGgc=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=VadVPspawbNOB36DRFYkRy i8r116EsAEyPN88mW35Y=&c=k 4B P34pjdwzi3dYkISFwGnMjPh8XPK0CeTHUztYrVW6Hi5zaouDXOa0s SdKmaIcCroirLUAXNloK95a5VRawlqnKqrSRqu7gYWS0OvOLy/8tW6nGkuomUMiUsVXDW&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=UQ4iv4IrrSaIRuj/L4v9YeelQI6omBr7NMztbLUS bs=&c=DFrQRRxmZTOCY8N30zJkyUz/IDO7aiOsOgoAXiR5MKpuyNeq/BHuH3J avLTnGVxpcRIWNG39GZuXhpncryMiMjNqEqz1z6sswBzPyPtFP2ddyJTnDQu5QyoWpT8OsJ3&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=UGC0RV4VihLzDEEaU/L5G6et5tk6dFu6OEVkX5gHuiI=&c=pGWMI13cw6bEXur08VlwNoWHnBI4CMDCs4Xu7Wy4y0BvutK74Q/ 5490 zNw7i3Ou0pNyK8ySHwBe3oGh0AK5TkFq4p87pnE6BeJQP5b4S23SDnV5bMcRTF4aaeFEAc0&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=fwBd7omjE0eEQ6o 91pCfSF7YoB8/ tIysMnm1ZYfss=&c=4dE4Vku OqwbCtxpRfTy7tsOaflQ50B6K1ADOndcXTdgJ/XeyM0042UImEdOCaTJtmMzbSHPhUM9EuLfABX84qpYo7ivunLpYPBjfimgsXW7kDe8suF9F6vajL5pPl3M&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=4cfgy4KzmreSLd1DdIdCIwIqDd/aJmzNoL/xffTvxb4=&c=anUAByP1TMVHQv0AXY1mwliw17YhXXX9IyXXgxxskp32dOouIzUD/G6yp/9yIlGJ lP0R5FHiezVKlwm4qJdWu6epxXpg/mbZzx1SE2n05 M29/rEWFIzPfYkIFS5aBW&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.cycletowerbest.com/c?x=YcL9fWWpqy3W4InNadiaA2snYTAiVR2pxwt3r8u1hQA=&c=CefYh80Rnrpt hxt/RlOZEIqJZ8A2LSoTLgY NHlO8DSBdP2HUHb6gVFKo02jvUZDFyaeTClDsZwfrG/h4NfKMbeWzxJl7xnZuk/ FOXsgSTev3wyc3oeYkAEKDUm9SaIH2 HvDTX4FOv6n 5Mazh3tmOqBUT7EA1TbWtaPRBfFirMEePcBKMV7s7NBlSsLe&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=DcH1UVHAEnHiEo4OES zkQ2Zzcp4valG4J42B39T1oA=&c=0HQcso0rznMFvN9Bc1MllGod/LTkkHeokrGfgXJiYvx4K9Y5y/xvNzuh C0lfqMmhhw0JAFGPkyZWYtbaILuUtei8VEZ30uEwaO1VqQcVlMAf6Nv6PbA4mvO43n86Ays&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=JFK1zEcyhi0d1AY2GSDlmZCjw7wD92NqLk0xE5gfuC4=&c=2v0fsPcLwO5NVqVFNa96IOP9BmY7owjtGgvbBfzSSu93gxca84nzxombGEO/u2CkXKIiCHCCGExYYPwJtBa804AVwB0pccTOh7vLSLr6iWiIRkQdkLHo9kmgOI//UeXsTX5uKdg 8ik mFfl66EKU0rPVKE/63UAJKZdI2yj1nE=&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

http://www.presentbitsshare.com/c?x=LAuTVzDoELQvR2sujyWSimN/Uv88nIGFkKWFgvAm2ws=&c=Og8pUf05zrL0bIT24LFy/EZKq7KC4TIKYp3tsUluUAPRwfB6eNfDz3xq8RmqVlcBAxvOJ/8GFlkE7fIvaNV1BENxdNJ/3jPZypj2ecLFP0tTkVxDiJtS/ 71V7dqvhL/&downloadAs=expressfiles.exe&fallback_url=http://static.updatestar.net/dl/.../EFinstaller.exe

Remove expressfiles.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.