home

freemoreaudiovideosuite.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freemoreaudiovideosuite.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftbundlesfactory.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
217cb86e7a47d47c8c04feddf943ba16

SHA-1:
6cb51651f02ebf07bf1e5a9f8d0f5c549df94ce7

SHA-256:
62b0b4473907283e268cdfcf51ca66544f7e1bfefcd48e23677497178fabd4b8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 12:58:20 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.18

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freemoreaudiovideosuite.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0ti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:0EcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freemoreaudiovideosuite.exe has been seen being distributed by the following 5 URLs.

http://www.giftbundlesfactory.com/ryGDiy82qnpBekB3BnIE2MDlE2 67yHf5zVodWVf3sBo0j8gsBu_Z1GfoSncfYJsmGltJejKlPMm8CD6A1IJU5iuo1_5r1m2DSTcLQrPS6gw01 wl6FnJ C8Fczgn_Im02WoZhv_xUz389HrLZFqYs jCRAw1y9tPjQE i84QvKV6xhSxbafNqfTk6oaQCHQA57CNsgOk nX24hkZz_ pWIGmr9ZaA==-G1gAAMTaOW4Ms0WZv6wGf8MVrqA45YC9VWCB1HZAODgOnycTJemNUb7NpsWeCXinNtZF8Thw0MSMPNNzqtIhe7xoxQI AA==

http://www.factorycapitalstock.com/gScQRTP6XJgX_75JxViX6ofsTmBMXKREUwZ7dOH_giH7q2uke4DrEZWKLqYU0kWoG7CjmLa6FF3CEASofvCiT5iUv knEr0UUI w7LQTx9V_RP7JZTsZVvAW5wD0r7k1XIfPHD5Yv5 QFfqodbSe nH9YkeuUQB_PpeQPKHfXFj3koPfa_CKkSJ0Ye5CeZbyDaai8s_szN25qHJzHRmWSD5lolPES26wF3w7RWUUBUPh2FPA5XHQaGeIkHrweqh6S3J5q9wYVepu9jDDtCMznAiPxPoGCY9A6fCPyY7Hu2C4PxC cfeKHWGXDgutlgbDzQlsbLK0tbe54J5hz6viagfIMZBRWYqHvt26hxxL2jzgxUGqAYA4Ju gZCZCq05CxspSo68PCGGqo7D3cSU0uWHG8N25FUd8orFFa6qGYIYPyylqqKuYiZqizNsfBAqTbLv9nxcj9Nbh2VubWV2WveZSbhgDCvdq4vxkvFmP 4g2vL8SdMzt8EEEcbArBAzkm5O8V_BCXUjHitIQw4ZPWwLmtFmByQ==-G1gAAMTaOW4Ms0WZv6wGf8MVrqA45YC9VWCB1HZAODgOnycTJemNUb7NpsWeCXinNtZF8Thw0MSMPNNzqtIhe7xoxQI AA==-e

http://www.taggiftflash.com/b0BOyQSDkBIzIXmjRl7x0xE rg3sTML PByyGmTYg1uyFXZkKbLDQ89zuiqSGG0InQifEXCXOzDc9nVuDfU3 imBphoNzUAw5Scx1IxmqMA3PoOldmq1ngbUfHxF_u58BEJq3MKufxVmyW1ICO bSwJFasFmDv3xRWCZG7BbKi1ilu48E4kDugxyvIGJjyqDSVy9kKuS4FSVRUQflcQEEwSMrk68Q==-G1gAAMTaOW4Ms0WZv6wGf8MVrqA45YC9VWCB1HZAODgOnycTJemNUb7NpsWeCXinNtZF8Thw0MSMPNNzqtIhe7xoxQI AA==

http://www.factorycapitalstock.com/vAAnTXaSXEB4y2nxqugu fAfMmfujTrcrPiR9VaaJv4WWe1_tCSCL _8w_W5QQISHM2lT5Np2AmNr0NS8SgRDy2EK62VEW6sHEqiZi68xissYPfbogO_HmXJ13IamJLZLpo3Enf9skzzbnoGnlTelc twjGXRUMFEp8uUfYiGgiVg8MXe6F7h0t6JmAoHBFP lxs0e_MGropWOhzL5VPAxTkLiZG5w==-G1gAAMTaOW4Ms0WZv6wGf8MVrqA45YC9VWCB1HZAODgOnycTJemNUb7NpsWeCXinNtZF8Thw0MSMPNNzqtIhe7xoxQI AA==

http://www.taggiftflash.com/9qk37z6EtKVNBXkhcCDmjSo6B2QFYnFxRCCoLuzRNNgCz4K7MaoUgc1o7b 91tJYQXb0n9Cuv9msbNr0Ex7qCqMUC9 wL3_DZc jmTD0HIsTO5kJecMLUOu5S1DVqOvMecDNmZeKk626n8nqouG0PDjPCRMiJ02sz6mn_yMYKscB1KO6Xm1_NtaIK1zDbvNspTqv3yCS8t2iGrJoWWYOTQFTa16w8g==-G1gAAMTaOW4Ms0WZv6wGf8MVrqA45YC9VWCB1HZAODgOnycTJemNUb7NpsWeCXinNtZF8Thw0MSMPNNzqtIhe7xoxQI AA==

Remove freemoreaudiovideosuite.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.