home

freeaudioconverter.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freeaudioconverter.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftbundlesfactory.com.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
da6da23489e1eb23df88dcdff762c7ef

SHA-1:
355052e0bc413eae86b28327850f742fe0115fa8

SHA-256:
664a10a75a99d582d3fe67c301929ab22bf469df4b9f49808e7ec2718b933d81

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 1:16:09 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.7.3.23

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeaudioconverter.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 5:00:00 AM

Valid to:
3/25/2017 4:59:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:nEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9345

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freeaudioconverter.exe has been seen being distributed by the following URL.

http://www.giftbundlesfactory.com/FV8H8RbgSApL9y8skoa6ePtPmpdR974f7w_1a0iXVPpz_03u29amBMkuBIVeyxy47WymIWEMSU8WgukurH0AuPUMecb7T Sj0LULAYeOkenrccAuJ5JExPp9VdXdPtl0GX169uhA6X0wqh1XhN_Rq9Jki1SHMG1X7ooBArEorTXAzH GgVATGlVy8okXWfLqIgoO8FFdinlI jgg0MeznrMOO4E6BNBRqEnUUB 05e1jJb7_krQFwZ7J1KlCHfZ02nQErCMchpiIM 1E2 bONc1Z0Vro57Pcd SaEHYV2xKtUsDAouQI9Lh0AuMt7Ow h6oUXUhRIQ1skUpkmfBLNEPUpz5hdmI N0k4V11cvNIaW5kIRy9creL3rx1tfzMnObxv0ZzDyS vjSXtBwll9uD0WCXJ3R4MsqR8okPGcnlOQBRZQL7mZQPV rrwh9vvgcmI4ZJ9-G1gAAATEbTH9D_nlYJZukIWDKFyDOjlg__7LE2trHlDMgXOsJIeo4f26xhjfZn12zk7AI9VK0lOZXFx WRQ4dr_Nfx41Wlc -e

Remove freeaudioconverter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.