» freeavimpegwmvmp4flvvideojoiner.exe
Overview
Analysis
File Details
Downloads (3)

freeavimpegwmvmp4flvvideojoiner.exe

Web Software

Beijing Qingchuanglianxiang Technology Co Ltd

The application freeavimpegwmvmp4flvvideojoiner.exe, “Web Software Setup ” by Beijing Qingchuanglianxiang Technology Co has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftbitsbundle.com and multiple other hosts.

File name:

Publisher:

Prog Lite Installer (signed by Beijing Qingchuanglianxiang Technology Co Ltd)

Product:

Web Software

Description:

Web Software Setup

MD5:

74e32eb1d84ba44593b0bd32115f5709

SHA-1:

a4b6b6e70dfab6fe35eaaadb24d723ac917c0492

SHA-256:

c0f1dd2dc28a66e123c6437a4280ff8a5e3b598936d6fc1fec0183bfbd6860c5

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/16/2024 4:41:35 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/InstallCore.ADX.gen potentially unwanted application

7.0.302.0

K7 AntiVirus

Unwanted-Program

13.212.18461

Reason Heuristics

PUP.installCore.BeijingQingchuanglianxiangTechnologyCo.Installer (M)

16.1.27.22

File size:

904 KB (925,696 bytes)

Product version:

5.0

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\freeavimpegwmvmp4flvvideojoiner.exe

Digital Signature

Signed by:

Beijing Qingchuanglianxiang Technology Co Ltd

Authority:

COMODO CA Limited

Valid from:

9/11/2015 5:30:00 AM

Valid to:

9/11/2016 5:29:59 AM

Subject:

CN=Beijing Qingchuanglianxiang Technology Co Ltd, O=Beijing Qingchuanglianxiang Technology Co Ltd, STREET="1901,Moma Building, No.199 Chaoyangbei Road,", L=Chaoyang, S=BeiJing, PostalCode=100027, C=CN

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00E5F50EB929935434546FDDE8F49FCB1E

File PE Metadata

Compilation timestamp:

6/20/1992 3:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:ktjvaxVYPchE3nUeRAJv5H7puxtqvVQXldh8:klMVtAUeaJvxkbs8ldh

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9366

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file freeavimpegwmvmp4flvvideojoiner.exe has been seen being distributed by the following 3 URLs.

http://www.giftbitsbundle.com/c?x=FNiTvkC1YxWv9JYZjqo2HZkHIJKfNSkxh7G2ZAJiL0g=&c=UMM7hEY7XrYRHBHStVobJP2llGklYTFa11Q61F/KCqJqTO1GEkIy21PCqFFYZjSmdkS46KVSpBAfBCumNV714 8PQuYkrW79XqUyUyeYfxl8Quf1t/zb1oJgCBxS3ew9&downloadAs=FreeAVIMPEGWMVMP4FLVVideoJoiner.exe&fallback_url=http://www.downloadonic.com/freeaudiovideosoft.com/.../FreeAVIMPEGWMVMP4FLVVideoJoiner_IS.exe

http://www.towerpresentbest.com/c?x=wc8AFzNMaIexHMOrPGaDsCNhiXO8fRmNVifld1FZ7K4=&c=fi2t2JtVMcHT59PUGFzyeD3qEgsw Y6MPSoQW81CH1SEf5dX5GruwSnLhXi27yHny4j1TfaVQ4xgEK3u0 Z1LdwSkKK2BICrRsjv9mU TlHQEDAIDlA1eAUqwe092an5&downloadAs=FreeAVIMPEGWMVMP4FLVVideoJoiner.exe&fallback_url=http://www.downloadonic.com/freeaudiovideosoft.com/.../FreeAVIMPEGWMVMP4FLVVideoJoiner_IS.exe

http://www.cleartownbest.com/c?x=v3rpI8LxHOfPlaMovcRiMtAKOZm 5IGumC07OS6UJ6g=&c=jpsYZYQUVGkm/L5CSBZi8 2Tf vvXDGq21QqWU2J86MYfYZZ 8TC9yfBwecph1XODJYJSmddWezQ9mi8pXHv3SD0Q547e1NErlrHkGcN5y tnilPOTZUiAm8LsnN6Vbh&downloadAs=FreeAVIMPEGWMVMP4FLVVideoJoiner.exe&fallback_url=http://www.downloadonic.com/freeaudiovideosoft.com/.../FreeAVIMPEGWMVMP4FLVVideoJoiner_IS.exe

Remove freeavimpegwmvmp4flvvideojoiner.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.