home

freecddvdburner.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freecddvdburner.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.taggiftflash.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
6b0ab048898c54f13c5aa6fb4abc0ed0

SHA-1:
a60b1d2450d1017278985f62d93ef0b7a088ff73

SHA-256:
ce73d16102dec6eb1382049a18701397abb71466adc17b0bf1a9ac8a238a25cf

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 1:25:26 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.11

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freecddvdburner.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Sti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:SEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freecddvdburner.exe has been seen being distributed by the following 7 URLs.

http://www.taggiftflash.com/3ociOo RsWJkuKi70Zpv3vvmZeGG6bnOPm0gqkKNZy2yItemIXl9XqCfnjcTudOk1susXvWJiOL4LDdvZPXx6ukcpRyv4hnkHrC 2_90bPk3iwBNpuYDmOO5cFK0vE 3qkSAyaLtgAyRiMLc1ie37vJAYVNERE2eH1SQfFlVY_DAU77ND214lDXdE6 xelAhdpC5zskp rmg bKUvuSJ0IuxKWI8BA==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

http://www.taggiftflash.com/TwwKCd9W1sNEE3sEcXUOg9jurhhnDBVI_G9YetWGkvskfQ80qDzwVgTRoqGKbakM8nZvToXEv7L0fv4lRmq K9k_dtX_HrkfNvQA856xnM81sMEmrFGhXNmmZWX6XiOaIXfSNEYM_mwPhViMCbKy7Glun8RXcOQZ1YT75PS81cAq2EltSTGyMCMolHxyeC9aGe6SQdiaSfu_HD2AESG8Pyhk_kMJ9g==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

http://www.factorycapitalstock.com/AjeootnRw5Gmym c6gvqt3 ZPiw6 41DVtcpeOnDViRmggrtvQAG5ICvtmA5UZANS o48nJnCn_0Go01tDnUqWCQBs4Bfw2s5LE6TBax5SyzftfZOTw6xyhU6WHsWaXV9Q_CAlZU4eji4KtzWC1RfTg62HvWPxuZGk6S6E07mUFuv9b9eYxMtaIfzcuWEEXjo4lkQD78NGli2gvE_qgo1VF9tOG9h1uVhJKUvMvBVkhNkVIiodMbNA96QuJwaoRfyFOAnQpirA1Z02 lFERgzHcwTmGKGT4ul1sg8ySYBvOmpwOZhge70LGPoPS4cnGKCXL2UdYnYg1 Ydd9DXtHjiJd4f6Agsmqtsw3VSX7FKDN S5MDRDYyOt3YTlrHmyFm20GYndojWoLZKAADojGCsrfSkxm00DA5bqybCLQjCFGPfhosWRJQSoOH3ezPQpLAhX96zTXTQcGUCj2u_sokCyDrfAAXw==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==-e

http://www.funtourbundle.com/irLnPxlr62MjI7_ERMj6Qr4vEApG1roZ5cXLgoUqKDJ9maZ8arxVbwAn95aYyJlDYLl5e9BIyqWBipXZsJft8lL4C_it9LCQ3MuodO140SYQ3g3WRe7u 1PWVwEydodgavakxqS254sJrYfmDthuP6FA7rB6wTGoqsYO_bkkZMrFVNWM6UzCnfxH1_LjDsm6b3YRJhB9LnX0iabE1UHlNF6kEcQ8NQ==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

http://www.factorycapitalstock.com/X6ry5UZTiTLpo cmka7P7sUKYJziwD7583NRqIZdaRvncIbfaTvI7MbZxSrr2fJp4BaUyZBNW_3iOOs6uN5MLWY4IScTI2bsfw5LFMuztOIPwhp9EEimUBIyi9zbS6y7htFml047vgQyHXIytguZG0fNiG0VAkR2wRN7uAIz8TJg9V8JlJ0dtZVI91jkpo3G3zvdGU8ziLTVrVW2pUX4X0ftxIgF8A==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

http://www.taggiftflash.com/rPbe3XtLTg3qtTP3Exfu9CxGz0UJPutN4Ia fgt1BVi33S7QLVreqopD2xRbUXcEMhyDfgR7ze NjX JZV4lj cIdFJwttWra0Kjy3ttl QdnropUxiq2bimvvx6Ky80IRzqHGd8PGPOi4H4fRsEou O9Y_GuvtoDi0FrqD04duHMTZ bkm7eO4zbEaKDauquZ2WPsDrmzKbllfqu62y0VGAjqg2Nw==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

http://www.taggiftflash.com/Hl98Dd8oYRaYoNtbLvfFiR4l4CdxwK8PWSVjv9iTwOzsfeNeZFWIetNDxEgXDbMoHE8Lf8GGyW_SOi1LZ8Sd8RHVZspHuX6mSeV6jA0SuQiRmMIdQ0eNuWp9O9jeIbPMMq9ikEcCof8AZFrCltrXM89n0rN9PYu PoUwJKceoR4cQzXWr5IiSxlj84oJNCoTK1rWFB1smy1ABf1mNTy PChfE_iyvg==-G1YAAETdFtsNXYdgFqwGWTjIhYkgtOSA_apI2h4Q3mPsLCiSvDHl12wnfGWCrmSisjFD55tX8E1VZAEG8lNQs3XjJw==

Remove freecddvdburner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.