home

freeaudioconvertwizard.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freeaudioconvertwizard.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.funtourbundle.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
d391b77f31085e723a80c4b71d482633

SHA-1:
35d7deb110274d9d5ecce539958f4ab8b5b89a04

SHA-256:
beb0ed8f1b563ded32edfdd72c96db0b677e453fe4721afccd53c2d9d74a5a40

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/13/2025 4:02:09 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.7.1.22

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeaudioconvertwizard.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Wti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:WEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freeaudioconvertwizard.exe has been seen being distributed by the following 4 URLs.

http://www.funtourbundle.com/gCkwwW6YLxrJHVB1acTfQx_zuJr1hW3ItIA5aqTdk2f6s1 FKxpgdeORokPvf8cG1OGQNkKyHvX1z4IXzGPDLWU2hAwlCKe8IapEPAfRPbDRFPpL3TJEhhSpR9cD oo CTfKQIytmPFQMlTXEkhwf9MF Dh1Fqw6fIPiQVtSbrqOQ8rW7Kb5cz0rra7QBa9wuW0gvImzwShoAo0APEKV1YWly9ZPag==-ixmAaHR0cDovL3d3dy5uaXRiaXRzLmNvbS9GcmVlQXVkaW9Db252ZXJ0V2l6YXJkX0lTLmV4ZQM=

http://www.funtourbundle.com/Ei01HtosQsbvfbWYjdV QZzkApWPCVZo9aWyp9b0y4FcyKL6brkFzt7ElU3VRaprotAc5mORzZfd3WoEK_0S14Ix1 dtK1fGv99uL59xW0n0pgtGWFvW91omND4LB Tzeoeqbl5VNE7vWl6JEB7JHkTVaJVh9FFJTLLMY23ZsGcy7KZTnovC11MyqIH6TfypUipHQKEmods_2De7yEJPhvgP4gqinA==-ixmAaHR0cDovL3d3dy5uaXRiaXRzLmNvbS9GcmVlQXVkaW9Db252ZXJ0V2l6YXJkX0lTLmV4ZQM=

http://www.funtourbundle.com/qVjwbe99XATQsWvj5eaQcvY94rFwwyRf2l8Gs9KOXzZj0ce3Q 4WDKlCm7t9eGawC3GEGRz_fue9KRmZDHDTRDz7qlq8UY0NUMStBnbkR62XMz2wZBlyBN8w0VomIjfGfJMakudanOs wPSdgNzGgCVP7E_LHij6Y0mQ0wrW7NOl1_nZcfFc1CGaQLHG93SbSKuDlwFCuqLCoBp YhS0GaUHEBK1ug==-ixmAaHR0cDovL3d3dy5uaXRiaXRzLmNvbS9GcmVlQXVkaW9Db252ZXJ0V2l6YXJkX0lTLmV4ZQM=

http://www.taggiftflash.com/I91dKCClCPlwgNmXRTkdOXmyMs3Pil0XzJPoCD07xjiR6L0LRlcWkm1kNNKKsGeUfyJ3WwiR11q31yJeYC7wf9LX5n_fr02JKCi3Br9Kz9DPSM_geQpWx4toBumnkZIFCgx54nxCI8fqt1cZ4aSQUAUoXhclXbDin6SSeuSdFVY6qZWUCy1gVymn2KfIB_WmX ErFnQ30CjlZ4SSlRxNWryUQ15iVw==-ixmAaHR0cDovL3d3dy5uaXRiaXRzLmNvbS9GcmVlQXVkaW9Db252ZXJ0V2l6YXJkX0lTLmV4ZQM=

Remove freeaudioconvertwizard.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.