home

freeaudioeditor.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freeaudioeditor.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.funtourbundle.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
574c8ff6459987415462ce6d7adde445

SHA-1:
748fa213285e965ed66f6d2356d4a41a4b030143

SHA-256:
c01eadfd1c9d62a5c194e28eb2f9c089ddadb9bf1c6a6b843ace3e35fda767da

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/13/2025 4:03:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.20

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeaudioeditor.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:vti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:vEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freeaudioeditor.exe has been seen being distributed by the following 7 URLs.

http://www.funtourbundle.com/sTpCUbGAnwA0q8Pxwn5vwtUftv7Ncd hphRKrRPhgAiu2n4EXwSwhgnuuuP8kSGUkcf03cxw_8RZHm9S3LkAn9RBzOKTdhiHPcW92ISkHvjM5G3X8aGb1xvLRssvMch 4pXkhHozNN_UfqIZvFjfLZyv6s6rk9iBP83AT5YdiPuHGUnxFLRde63HapwAcauFOhyCauk2GS4HaE6rPB8th8smc8kWfgFolPWLN_ChiRv_6CpynG_08WyDUr4z25Tz7lsuZezHIhb9sCvWgINwJhqtSZAbsTjrwKiZHl6jiSy Xxf Yrsr2MrQAecFrsq9Dlq h orRNQJcIYtmDOhobfR2SU3FIQZYzA8LTCntiUACM7DKIU2MHLP_GXA_2bHr3otw k_kPif ooyzJl7E2hf79_xunEV_tIMcbFxPNpACqJ8YtjzqUAGdpDNqNqe ya0AgYrRaGYPdXTdcCj2l8vqly6Ew==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.factorycapitalstock.com/ePE1tyxAB o9FnGO4nMVNNDn7RNYK9KLuSyRG8vfa2C qOJ9QII19qz_fKUUk9iMX9YGAmzHVP 7YdDYLwWq2Q_tqdFc28E2CWv9lOU7sYLnY4gqHzky95nWZmzu9kQCK6q9U1nFCUlQIW0jQOUVXO2EnyXjjeNcgwNom7_Y0DI bC rF5qywXWGCMSo71siH9bvWHJaATjgkwzSTQEcH3fzWAhnzi p Vtk_0iqIl8myymEjcWMIp 2lMhwqo2rqYh_Z8HrEV9Tr7KdR1lyrB2J HjHJeImdxqy4oUIEF2Bm1E1LgWmZPWjIpYjEfXpkdpePTFJ9oMgtNQMlGWVgPQqjjeXZY W2KlXgnxD4HU1uo3E VQp legR S9GmXZAKo6K2YphkfaciGBMYcXS1n4PbRZS_8Nq1unxuKwIuL0agBg_gnbNuWGiN0dibGKDGe8C6oeLsQ3kFrYy0HkG1Sc1cVggg==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.taggiftflash.com/4zu3GO5fJj_goSACPCRWduZDtuJAhKAm9VmskN78qwhhpZxc0e5E76hoRmBrQ1ohOzgW8PwjI1pJ0MK2i1 IrPhWIpnv9hm9QwYj9eZ01kTR0P dxk36AgE DVHTHj5a_oAhB7i6aBhfbp_ETGgei6e _ykYrkGB9Q4hhvgH14bLpTfohjH57yfVCCOAbBJ0ddpG0TQ5x2EFAyIZZRrsbITFJcSc2anlNlotBQflu75gLtLiQYyDt9YkoaGwx84Fbo2ilquelUicelQGrJli45x8_jX5LMhY3DDWWAOEANyKMNtrBcha EE8Swi2GT73xTu1CcBUUc8WN41_HDwsbFQ09DsTorCR4Qi_5zQ2u9wssFki4tzOm0cXJZMpfu8mULD_QqGUfnyULfHEYs2maUoD7p_6diwQwkUGJVyWr5NiPihBmtgDhVQNTI9YFHO5RpbDlcB0QvrevQ co6UYLZqKIMZ6GA==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.taggiftflash.com/vS 4XdOyJchB2hx VQ4pi_sI53FWvaGfZBtDSk5OA30Z2 OwYb3lQZpxFX1Wx4Z3JDtp1Mti6AY8e4C4h1nevsibh90zqNoZhmuLOVPzJmMKNQkJVruYqYnOlhLfBcgHR_PFkztd_eRPCud4ZaAod _YcpJYs6AscSdN3U_UevyiD XcGSe3JI1h7LAx1StTzqItvsdbW4OnjqaOGJUq4j_EipUnrzcLDnzpi64aASPRf byQvvDA3Sld5tepXmXcL51OyXXDw5yigLOxU9Y L8TxZer6DE0T j0OQ_WocEnVngxi3ENQzHCmconhNPDmki4QQhW1v8Q2XqgyfdeDb4_ crCgP4v7Pkq1ltkByymMqQLUQF01OJ4fQ0CNoRKtyXuWn6rs99uKKt9wWesOuEp7KwPVKjy1jYFXvR67oZJHyQ_L3R3zHsbVpQjUnfJsAX7Laio0iZ590V__WgVLLu5IlGPgw==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.funtourbundle.com/kH p e5gjuEoZ 8AXc6AbiMqNHx4EgKgzRm_RMwNCIp3uVY kuoFPJ5WfsuNqY9MZbvCoIwyk7_k1eetCzImns zvfHEUX4AmE11kKD_JlR9RsJb8lvMCOdWxSgkfKWNN_REXxPLnmry_7R0fZRjB_wDBrevptoANJIvVqPAZkGEwC7n_ERcPJ0EIfc XD1QAnQvRFQFgjswXwM3eWCfYMEH3b3ieSOO8V1Fg3IoNjg9KpoaWOtqxWFgTUlZ1qhAVsEV FPaffZ38oiTSkNzqAM2xxucrkIvyPuF24KFMLoLpfwdQNdR87tvV1o2juGNmYhu0vrzoim CcFyOBcZtniS3Lr5yseLB7jI5FRB2jnfQEksYOU9Z9zKZyjId5fs3y7ebN1vzjR8Tfw2j17Kp5SUhLplQoGIanTq0ZhpCUzYeV36 WCL5jZCR_RlwVYWuXYcoGw 8QgW2d3QoiL6A8Z5qDypTQ==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.factorycapitalstock.com/brJ2fQXyOXM5xpL7rZK806XWWmLCyND1bZJqA2aGv_FRX5rTfElpOrdPL3QM4GodwW6BzrK8x80R8nxBcMAvVQ_TCqAVuIxYq8eutvqAcCBMEYfcMLL46jYBv0LFPDD98CcjqYvr1b Lp1rq5tzkJmogJI0nqhEQppsAaZhwT1NXTgo33wJUZhkKfuR1FKgJ0R9T0HfAW1yygMnp4ag0YisQ_Iq C TkBmAmDGuSwtDmo4aBj_Y2v0nU AY74ZGmRr gSzLHffID2_k9SKb41gP3ZXRV2lgF ZkySbV nDFoNh 3vkaU_Hm yIiNrrt86D UP2N_9laZM09q4mAWhmyteZ9n8D50nu_jg12joMYXaSkgNo_J4SoljCzu_Qy5hVKnQMVZOq1Eb8iQB1pDE6ulZzmTXKdtLK9xawwxPW2_sdyNe4PEvQKwYosMPoJVeRhJNcTElIRptOzcOAzERtjLw6aIGw==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

http://www.factorycapitalstock.com/7Io03iEIfUzk0AEnV h06Dyj5nJg1v9_19Dk1unStpp308GCg7WSr4Af04WNFyclH4LkQ__fueOTHCNViiDvwhhSl7P1U2_erytQMwG0Sg_pzvNX9XzKfn7SnAnuEufBwGfKmKwP2wWL_9VhOMqlA9CDxUWGJVAMH8 U06jYVz92PbaAo63oSDYgo5AL0NS q0ipvzAwoMZxnBbcJTdYWIilBgvyk0oRH4QWno7i6pjZ20B82Us6qUtLUAWxa_oyrETxDy9K1S_6J0GOy0RcHoinnlTnSY2o6K1OZx7IdkdRlwXzjYUhdsc TxGyTfCUM0CuXQ1GiH6gGdBr9sRgChN6cekvY1cKr0KJuyMV21AKvZsADKfKLYDs3JQAVj5NrKlQnZu3zgvxMu18 qgyiXwMttnfl 81Bo_L5hiROtD04fHA7ppqxFtw6WEjzZvpNTxDvFVj3s9WrOcO rKMw5YK5d0pxA==-G1UAAATEbTH9D_nhB7N0gywcREGLnrKQu6FQ2revA dYMVSH6MP1jXF8h93ZNTcBj0yrtKfztXj8WF5wLKEdrSsf

Remove freeaudioeditor.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.