» freemp3joiner.exe
Overview
Analysis
File Details
Downloads (12)

freemp3joiner.exe

Damunikut

Huaxinwantong Beijing Technology Ltd

The application freemp3joiner.exe, “Damunikut Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.taggiftflash.com and multiple other hosts.

File name:

freemp3joiner.exe

Publisher:

Huaxinwantong Beijing Technology Ltd (signed and verified)

Product:

Damunikut

Description:

Damunikut Setup

Version:

2.8.3.7

MD5:

703653cca207294576b4ca8f27513875

SHA-1:

201d327a55cd8a4b65f8d5c0741a30268b252072

SHA-256:

362b4b4b5d4b15945b0f82cf663c9791c96361106ee7cf5ba249238dc5ce9bc0

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

12/26/2024 5:54:32 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Huaxinwa.Installer.Meta (M)

16.6.21.3

File size:

915.6 KB (937,544 bytes)

Product version:

5.6.4

Installer

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\freemp3joiner.exe

Digital Signature

Signed by:

Huaxinwantong Beijing Technology Ltd

Authority:

COMODO CA Limited

Valid from:

3/24/2016 5:30:00 AM

Valid to:

3/25/2017 5:29:59 AM

Subject:

CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C31292C6449E082B3FBF99E310243E2E

File PE Metadata

Compilation timestamp:

6/20/1992 3:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:SyiFYkHhfdqyupoYSSvZzXk96X5EifGIWggZrIy:S7ekHOyunZnJEipE8y

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9382

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file freemp3joiner.exe has been seen being distributed by the following 12 URLs.

http://www.taggiftflash.com/R1N7Rnm48cecyNtVpUPgkswFN0REwLqMQQ6ZhiWThdq2jU9NuVE7LrELH5rvfd3yOpU4vW4Zz64yY5soyBfY3L2Fbks9ybNMmgiEjVrPl9vZMKtpAHKK0fbd4pyCyG8GeQ9WLGor7CdvhGIiR9BVBgnWdgcDdyVcNaBKAweHbcnqGFivK 0knURfYw8RPB8qgjnzLymTT3hLR2eELrV_ZL4vq3eX3IDBf6iZhqiaOGCOLBRRgZea1_ZQCVTrVSh0bUWDXYM32JzeOYyyowaLzLfxqZDUVStySQgbUpRiMiFX6porWSrsea60glGZD4Ecs1pM8yY5YOs8kSWnFzAo6wMvDrsUPtacAERBucLKB3EUXqVqEep5AVOt2w_csZ9pT9TSO69w3QM0WMs7efKokU_odfqngciL7Kpb0yj3CpHOCxjJbAp QtyZBcC4pTpve9JUh5JhzNPFozGL4at7Or8l6lHeg==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/WVl6OTRQWEJ5Tld4NVREaHljQ1V5Ums4d1IydE5aRXBwT1dwelUxTm9XWFp1YUhsSGNIbHdVV0pwU1VkUGJ6TlFSU1V6UkNaalBXZElObmRyYW1OeVZEQnRha1Z4VTNRelduVjNOa05VWlZwYU9WWkdZbFJPUVdsMWJHUjVjazE0V1hKS1NUTTNlVTFNVjNsRE1FWmhhMDUwVGxOTlMyMXFRMUpJUmtjelYzZFdUMDQ1VkZkVFIxRWxNa1pOWkdsWGJqVlNabkpDZGtKbFJreE5WMVJwZFRab1owZGxZakJSWkRONVVrMVlabVZCWmpjM1VuQXhObWNtWkc5M2JteHZZV1JCY3oxR2NtVmxUVkF6U205cGJtVnlMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHOXVhV011WTI5dEpUSkdabkpsWldGMVpHbHZkbWxrWlc5emIyWjBMbU52YlNVeVJtWnBiR1Z6Wkc5M2JteHZZV1FsTWtaR2NtVmxUVkF6U205cGJtVnlYMGxUTG1WNFpRPT0=

http://www.taggiftflash.com/ja5l8nQgaflHD3g2gkNoQwmG8umjxDY0ABVZupw5UifUdTMLX_ia bOYoNOPC9Uc_dqmCFUnWX_q Z_Ed5mbkDcE9C CeOfWOFysZNQiyJaxMbn5BujYsqcwVESK9cFSKjy2Ig8cFNK8l1eQkD4mjo3zK2VWYPmRL1yDTEt3pLCXmTaS1GdU_PfKZLdIumsm6CWftT0wo1Wm6OdITWRcjhlUHC0ZqRiZKT7vP_R45oYEuSJaEi1QvhzbwxNDM_BWo9dmyyvyFKL29sYf39FQ7jaGYaHGo2v8K1hglHCe_n_yg40Yb oTg_r1s2AiQ2PBeQbXNE2Ll6qy0v_BGfUsOu7srBOsxmu9k6ju_UYWpE0QE N9hw4mwXUmLnnMQtVrptdxvmqSWhwvM9 uOPcumjaNtaIDWjw_rC6FJvBt0rgd20enNDe jYr2E3SJ1IIKPk0DUegLOgeS1ac9IxwOPXPvCKCrNg==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/7Fk1l_dGacKoe5vBDQCu3ERfSr_pyWOuUL6VymegmWEWjm39ee7mVzjfc6q3WQYR6MaFEjRIoNdsK88NWo_BzfCPYMAGei90IlWgFYHYR2LLhD nR5ABdyQZXbZJQe3SYi 41eyiPBlrLBbhFHTjGJ_QUmYKF_OSsjmYgDlpYnF3IYPARsEj4YW4ZR_x9692pDdpSMqdweJ zeArsCwAvhH976uYY0NsrAydWASE MqAkY8SPDNU5qodBaMMxXnlCXB rdhABS9oLzkcTklS0hxAeujbGUUO7jLi_MutQ55LiIMRt221taouaRWTyTxsZBed6oZl44B_8gUN8mJ0wOIcuxeij7hWj46Ghjrte7WMFIa5Ky0Ef_q3knTNL8UsLppMb3EMzsLMgOcjSt8ZJ43CNEZlLTOgZCwRyZ5p317luTh cPl92vBPL28f8epUO WLzPDpD77XqRLZ5MNBTHSsxumqBQ==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/qWU0NXhCaRqtVvFCQeRVqXXYtmEe Rz3h8uy6k09ESO4Sst4 GIfyk6K1fLsmaer1Evh8StTL3dmN3B2 YSqQXtqI9cPj87Uix8klg1CIpbi4 Gg 0Hqo638LCS5411EbReeU_fVhzaDEK9Yo7s56D0 KXxyKGdpeuqLGKbim3PRt6kl5Dz4w7UCiJ6Nf9T7UJl4op1TJFKayDTn2Ox4xiQKOj4Foe2scPPO4EqVlSx8a7gKlzjC80VQ38zY VhYiJss5Pv4TDE4WmA4xytWMolM4ZwjLv WSnra7V7OEfddoX3ezSw3X101 M5tg71iWTayeGRvhgOgWtFogEojqEWW3rA63VeKz84FTK7k3WAZRbXZMAZTQqOaF1lchbwVBcj45hmKvF lPOgsbMYsCowvGV5Sx0020U7fx8GiM7biz6BcIblSSO8aDhkNQsImpi7rfIV4vswWpgzWL0Dcf6Viug7nBw==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/u 7srWkRrGDYufXkTwh5jmJDasbbSExOQvaLG0FAiTFpzds8nF6akgCoP HfZXW57AN3ah8Y3zaLjmTVji7gUVlBiglmE4rhw5EST0_NVxijT QQNmgwud67t5XYq NDDMiJ2J0O_QJqJGRUsw4iBu_e95xDl1ONrzKeo9W7o1qDE3jsL0TTz01QpsI14TelTVIjZhr1Igh72ugal3ixRY0Lynbx876ZoIot 59FEsT_51fOlkkuwBcomeQP9AB6OuoFTlqMfssAok1bQXw09Xlnq5wFxtAfZfGTVfsTbKdsN8yPrxrw33nZFPg0A9p5JtdXMpH1lxIxPPxjM9XCDrO8ZYFLg z4jPnaF8CM69qEj MMhC43V8SNgf5ylZ9OrzVndbkwI7ju V5ExMl8qKAb46oFGzg2u_tyUU21YFKseA97pi_Iz_8yDHTV9xJzDMmJhCNX180c Ltt99QoDS82kobIJg==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/ACZgaL9FASwMgB796MFuo5PGwz xo8V5Xe33kjhOWsCSJo2Ke96Sc qFFS_i0_WE069iPq1aLCD0MF8F832c4WfM qVqpQ7iWIkaxVM0IQazEnVBhaT5y5Q0f3PBFrfXWS28N6S7cGFgbu_z4OUWhaf5vdEkL8C3BIFSZW5Zddkp0B8sOX1xN78GOyU3hzL5j_o DdIJq8hElzRdjTCFcaDDBwQdJ8ZqgyRIZkZ_9pBKi2wMc8Gqjcw8JLyl_ OHo1dCfeCrRqQI3PsWOIco5ngOW0Y2ibbWLnWyWmI0uSEng9qi6oD_Gj7qrX55rbaMxEmI_Cq0PHc1VtY2rQUAzmBQbqH7y3XVimIAnb3ZZDFhFRhc04mCuE emmRtcrsFBtKmFupdlH1O8FNide8UcuncczRNbiw8dSZ4wh8gujjWF2L iCc3ELI6zlAwoKMl5PaRql4 gduqC8HZbV8A9aZObi3Mug==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/yqNpCl68T_BVTpqqtSXeDiMW2daYvTDZMVqVehZ1puzssWN3aedDE7EjvbCNWsKJ3LUEI6LencZJ1tPHgBrocsiJZSyjWU sK Zdh_riQhkuQ7po2vq7AA3skTnoRTqFijqAdnTrWk_WXSXKAWRTxTBRt0ft4dLZtOPJujg8UJndcs5c5rXHKCeq62XLAmqPtVNlxy9w EXvPW6rRMrohNla2WN3Li_ssVN5lka89KpG5XzTAf2nBWyYKGuzhevUBlQuCntMM_EdaDJiL7b93437jNLbxoOp4qctq2dTTPzCu1JEtc7t6m1Fl1sv3QaHMzTeREXKk1ITNbgWDVBfm946RDd9BVUVcH03JDlcvTqBeWFg6LJXMyKb4JUW7mPobRpozgiald1YzPksTiBUM9bIqnhF_YaJr64sUqjc1OiqEXgcKg u18n6e1uq8RQ0G33LpR9Ul6Zte_KgQfS0nqFzNDfEng==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/v83gzBKkhH TqtLZFaXN_NxY j6icXKLcuOTaCZzssikx6ocZiBAVChlq99Z2GJ0e1z3qhx0pANDtX5tjqzoJJEC53afcXpVWJFfCvwzQ57TuaSN DIS3_v3hy8UecfaiZ3VNE__kfR8s91SDpKW4WVXa1IrN4u9sWqYEOnI6wWO_yq218j6z6JTbeH_Y8PjwN1_urlT0e5NEBo9 6mLWdCq6xEBUOSrfRiIUzGn8c95fVL0SsAujbgGXuyG9WDvk1wrbrvvAyiAzRxdyD K3YuEuAVsA4_QvTs9MoWRO8s L v6xlew4lqmy3dwoum4CHGs0q4x7wiEtIvsQpYF7roUysbu7191bieZFTRybU nw22txVhr3wMkcgpiRlc5vBgn1Brmqsmwrug1gy5bL3GYOt2G 84AdtzdHudwRANNJtBu1LtgD2bIgOm41TQNHo_GTYdJNhGB1RjwmU9odJod3fiA8w==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/WVl6OTRQWGhvWmxWSFVYWjNjRklsTWtKaWJqZFhOV3BqVkdKS05XNTZiazFCV1doTVJpVXlRbThsTWtZeVkwVnFNRkpEUVVVbE0wUW1ZejBsTWtZMlEyeG1abmhOWldsR1ptSkdjVkptSlRKQ1YzUkdhMjlWTlhwSE56QkVRamQxUWpSc01XbE9hV0YwYWxGb2FWcENhbUZoYUNVeVJqbGtaMkZIU2tGeGNqRmlWbTU2VUdzeGJreHhiSEI2VlhWbFJ6QjZWWEpLVHpVMlUzRnhUR2wyZG5wbmVUSXpXV1FsTWtKS1JXTkNaWGRMTm14RldWUjNaVEJrUVdKMFVDVXlRbmc0SlRKR1NTWmtiM2R1Ykc5aFpFRnpQVVp5WldWTlVETktiMmx1WlhJdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1SdmQyNXNiMkZrYjI1cFl5NWpiMjBsTWtabWNtVmxZWFZrYVc5MmFXUmxiM052Wm5RdVkyOXRKVEpHWm1sc1pYTmtiM2R1Ykc5aFpDVXlSa1p5WldWTlVETktiMmx1WlhKZlNWTXVaWGhs

http://www.taggiftflash.com/jqYiHFDVbkaZmS0uinZUYQKNjMTK1_Bj0wagmA82YTR7gRUEUZBKHWA_f_gLeBmQrsSfgcb6A1Rh4veEX5Fh_e4b5BViULQgoDQ9oWZv0JOEPWvgE_2VRKagscB7u00SZltI6ZWqzhqTg_bX0TJr6HGyIny7g5IsStq3QBVS5HDQiXT2jMSwSdCTM_I_lS5zzg_5FwdX90g1yEaokK9cWrXTZr2E69R_cn Ql9qTi MHxBnp7kAfEjFiHruef2dvAZMHZtQsJuwiWDXVEmrGyB9uOEfHThYfsjYZRJxvOxMLgVHY0_UMvjfcGAo9dDjgv8nVL2cAzzyg76D1IgEYPPhQpbWfgm9tgWFAMgXqe2BY0zfsqCszBe4CMeDGNB221RQwW9966fLhKMPITPuA466tP99sTxfST41Cj7LnU 2m7lIfAD3jzaEAo0xITMckPLsAyBX9 SBXO0GqnJSqwSW9tjz2Vw==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

http://www.taggiftflash.com/FwWooakP4SBiiDDa mTMi8m2Ir7_MTViKGYlSJjrweL3xOPQK 9QENZdwdAHn4dUMXiWtWVdd6HZxXET9OHE8B2d5W_tY7Dtoy 2d3X1kMT2jOWc lw9HvxbX9CeUl1OBPi9omdSx7ihHTXfQ0oblMpG1eqm04D6nzGqh VCTE77QQeJO_DCYoThrmaOsZd7mDEofE w3 bLM6cV0XXE6yGYZy7q_X1KrLYkzkkWEfzACX7LklKCgm__XItbu0FNgg962ZCIg_wNB2OKrpuebVhtpqhVF7hBnUoQe1ie_mzmdfZ0_RjxqxmC56fU5vHV_c49h4KffzPwNMJ3yMOtOF2KAtRcNtFLEdsQm_Yl2E1CwqoHlUMLLNw Z2GsNgvLR_Fm7cmgylYrq SfMadcs365vJ4wU 93FHKDkuvHoGqtie59i_Aa5CFeHps1y4V5GbEBw1xnThVxBcserdwuW_OIvxLh3A==-G1QAAAT uzluNTTsUURkb8gbPrnjWoKWHLBfFUnbA8J7jJ0FRZI3pvyazU0nE3QlE5WNGTpdnuCXa8CYpbuM2G0lPg==

Remove freemp3joiner.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.