home

freephotorecovery.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freephotorecovery.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.factorycapitalstock.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
b5809aae549b94dae2990c5bba690d69

SHA-1:
743758cd6871c45ec01789f2a94d6a76b989298b

SHA-256:
7283bbc5f0f544e3e868cbffdc0cce6b3cf78f3db399f50b3c2a430accd9b69f

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 1:10:05 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.7.3.5

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Eti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:EEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freephotorecovery.exe has been seen being distributed by the following 4 URLs.

http://www.factorycapitalstock.com/PKMJaUSvobVB1ckdWoHqj77Fo KaZpTFZDbs7WUE0HRcC5URlPvcZ3ntThzwOeWBM2 gVWCVOLgAJBLYPrWm7lPIQjuPuMe7NNMfznstU8TT1DYsKejqCcJghWoYEURqY4sy16OeFJfMFa4Wc8b7Nvn6OErq0rXzjloGcGrbzGjnJ FSwamLugD9UE tCS7f9SbTKZitEh3OiP2f6lSA4s_9kXqMkQ==-GyIAAKRbyuTywEQO2NuiDnbYgBOKCtZdY JDx2XAScFWAw==

http://www.taggiftflash.com/co9JtudbazvgKgrVgP97yEFrLPJL_txDg3TmGc1HZVZoPT8QalThT60P36yKoslHYChW083kgH5Ei0N7OCwMwZNM_oBFMmz3oTvk2avKp5f99Z_SeRGdQPk6K3a8W5t TqcMmoiHBvysFOzwtgSEIQZnzx7WU4U7981i2BBkuaOMfi_lZXeSI0kl4EUuhs5hg_ByPH23lmlBPHQmwYYd6q36Mg1z6w==-GyIAAKRbyuTywEQO2NuiDnbYgBOKCtZdY JDx2XAScFWAw==

http://www.factorycapitalstock.com/EEPPZTIaVxW89MITUxtpsdZ9mJcnd7wdDB4OSCkfGMpVh5QMqWVaHHsa5i21ZhUsjhqLPcgtK3nndmSR8u KmByJ6A1uOqJ9AWHvIH 2v4GZAeipXzlDvYf8u1TSqQ_M5cpp8dJGMPe2fnEyxdM2ViJxuglK95 gOazVfAsTxT6oO8qZzvVd9pejsReugjtGzr3ofm9RdXO1K xhY2bUikIxM1xwJA==-GyIAAKRbyuTywEQO2NuiDnbYgBOKCtZdY JDx2XAScFWAw==

http://www.taggiftflash.com/JF9gRokyGWeGhO2Cs3wYVW7nqxpHjDPlvMx9xo2 oJYi8T4ykZi6BVHQYPd7 8dmsLyRuXwDEy7sM57rcaEd_xn_BJCk7hb8Y2CbpOvBqxKgbBG94u6G83YnIriYhO7_vL1W4HBzaoePwqRsyWM3hh7sTYKAhBmctwPnqbAwvpuEP1Usx9Yf8VjkpFqty5dOc5XlomdokcsIb0chtGy9hjv2kC_dZQ==-GyIAAKRbyuTywEQO2NuiDnbYgBOKCtZdY JDx2XAScFWAw==

Remove freephotorecovery.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.