home

freephotoslideshowmaker.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freephotoslideshowmaker.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.taggiftflash.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
a0c58bbc6dc5b460254a1bdb727263af

SHA-1:
e03410526b4b44a4857fd295ea0394b3a45bd6b7

SHA-256:
5e3b4967fd998af70769b09573dbf92d0ef20d0a8620488b10c4972432547a2e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 1:10:16 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.14

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freephotoslideshowmaker.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 1:00:00 AM

Valid to:
3/25/2017 12:59:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Bti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:BEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9345

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freephotoslideshowmaker.exe has been seen being distributed by the following 6 URLs.

http://www.taggiftflash.com/ugQ2lpL1bJbxGEZhv60nZECNrKthhamrnssL0wRhJJqcEfnYVfsdWNDPFdovPV9EcWgayMP8FfRaznHuyw_Zt9PBhLPpdHOvxyhXHo sVl58UWYHeU07MSjUpT0URMGficilFFLg5bImcLqNi47MlV66VN RTSUiJxWAUQ5j1ClwBuYuyH0MYm9K9nufLKDP8jaqLgMl4NV6ac0sQiBWbwRTwfI9lOisyR_6BIEvvtk9V2jsUKloVvr5e7IlxEZVLYJ6zzJH4ar6N2iEYFzLCbfuTi7UK62pjuf4TGMpOZW_XIDrl4pf_yWJ0I7flwU9NyuTnQrvcO94g6LXHzQZzxcG3 Gl6VVaumSptDRtKfb3JceuLuyBBfJ41w9kAA5850mET9T5NoXTHgTEVfoQZj8eIX8NNCpEskgriitCcNEko6uC8mHZV55HRjGaB8_9IAKioELxc7VKxXtVsgiL21TRnfs5Sw==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=-e

http://www.funtourbundle.com/gICf_oiyaOYaI0FqNj4x0Gs7ouIa5T1DNqEAzsYIeIGTdXGmTNi12rJUoNKlYuOPsWMjRcnRBvPwzC PJcV2AJ0RgxNXbljbz8Kqqu7UP2sjfBumATWpPFrFcPxkkfz0BZEyeOPXI4KZwkhsLAdq0ysK8 QMvGoJAnSY2c82tbXUgI8YTVYLlMr4dKW_9PrZjRuIiC9v2RMYcihEVfr615EME6I6cetBjDL1ovY7Tt3zzaGhms7pyuTxIHkeYcZ5mB2bZmGFfFGRPFSOZhzO0uwGN1OiB5QpIXVekqUtDsw0_fGgip3hSTYj386cUmM9oQVoTllPKbU1H5IIcsQS4cQmmJrVKVRVn39gHkjBQL_wxMyfZWLpP6FG5_biaMmgnzSqlCVHhC6CpAyHeIr8nFB uQiv9qbiI6Kh cHe qsOKyC0BK8L4QI1uC5Cpb7bQDefdwR1Yhse0jQy_ll1n20dmmdjwA==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=-e

http://www.giftbundlesfactory.com/_wxTlCi6XRkfCf8Jh5Ww2xyFDj8i hPUF00hgss_FFcyDscWBbcbWz31W98KrOhIwIrNpudSTR cOra75voRk5Es0y8ibb34OFCj6A73fjIT0sZhnNV8S0mEO1qSL36WVZTMY6ax K0KmHTDEiFS_Ioh1Yo_0kS1eMPZXDDtIoaEwo1okQ8tzQm vbElUA1rWyaw 2QA2gO4N8qgfi2k76PqFl MEJKse4eY0R8PpXbS73taDwkhe0NmMJACuzFUBUKneRBNFtrmtoq8EjzYe_3tRA6u3fENcU1LqVmNstRAh1pTe73Ti9JffDVKxrBkjhNkZfCxONX90pU4fles0khG1HO1_y6hhyRcOJCBGR_TbzPvCk7i7VmPBG v6UOFv6fCDPg_wzchGjQFpUVpIdgz5cBE_CLyGaGxxmqffvtkgD z1InjX59K5tHBztFYY979l3CJWhLCGVStTKjdJHGd7f f7A==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=-e

http://www.factorycapitalstock.com/_SQAeNjj4ty_ I7KX7W9WKp5PTJlHXiGoZcxh1HDrhuVzaTXJm2tjB2vp0PYnzITtPygLa g4nBuykhsyHchALtD2J8xNYvk2auQ_C7rf24Kgpb46z0TZlyKLdpMiC1KASRGGA9Oc_URUQJj8eKFGnyTYVfB1Px2xR0HASNDNTdGR9OT6sHmkC8t91A7TmmPf1fcUitt EUFdplIJAkBBGBMTJOq1CHmiM1ngcoFhSJ_yTtGF8iDCRz6AnT4d qusoCX37Xhx9uWRWSpvBxcF58 iyRf I9FkF4nrgl1AutPwB4ECukFVECR37dfRDkRE4hsU2p6WWfbSIIHwrsXAVQK IcCK4WRS1SFRiOZdOlUOuMSmacTQk7MbOArBcjhAHsvsfCUIoDju8D4r1oJ tbRz023IzmRoEsm 1O9uo2zVV8YElMwSWC8JTPxFEZO8sEEng5NKoyyGL1KePJpAfEScnO6_g==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=-e

http://www.taggiftflash.com/U6 e ihB60J45ypk9rsMF2A4c6L7CYJ7Wd rOn_b6GaJV1GA8y XTe4kY4HPNSnTZ10T9trcWTDRvvbQ5BGcs8Boqsw_mqAx9labieP 6hv2snBVxbJmS4RQCUUan7EmOMFgeNhJ eTo4fqhf074s L3pGaFvbSnY8ATIOxc78vnWrrWLLRyEdle LBT2u2R5O EM3y9zV6atLwgy8SxoWTkIvsG7f3XjhSajPV5pNO4gCwlgb376NJjLKxecJ 8LhmkNsOaPjyJmhbP9i_4JLWob9AsVXha7X0hifBSQQ7r1ge73MkJtyYeA6XaFnJVet2jIKqtuFCoBFpjxMETDMsQjfYlqho3EXxB54sp0J1e2nuAiq8AseR oPa4QmhryN3ypS7px82sHEnsq76ONf7RPizDpuxwnlRfl3ETi8pNN6y1E5p1RvknqihXKboBv7bU14oti3OE8s6L 3BPQLMSck5uA==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=-e

http://www.taggiftflash.com/9fDRyxVAMsIG9cd30t54CdlYeECrd1ZFOYv0KpNbakKA ZjWpxC3Cv3Caz5IRW31uCLe_bXgYig_PaaHaRQCTC4SPVhfGEd09sRDY9b93xAraJIJR VUNMGjk0UIkzLZEH3rNGLYEq6M9xxjnW_WHNgAhXH4KM7cGCrR3mQqDIdUK6j24JqNOIF4IC6DuRR QT1paNZ3CqyMCiX_VnXd6CUT2IAhnoA aRKO _A8Tu_j p OZsmXrYng18cXAF8fSW9cNduT0SBF0Sd8iDDmofP2ncEzMd1chTJqoWq2RziHG9JP4bVcAAD5XzhM10MmuLOqc_Qd CynwFqJJQ5nLAixzjtPwFS8yzvBaHTfAbopKA7pj2ezoNeOrX2nXJ56h3gEtrH c_A gnilEXvSAuGaqTOoKcmIooRSQlI_r5GmywfVqpXil__4HcQ_1rpDKQkuKoLEJT5qV7fDEnbDO_zyvUKFQA==-G14AAATKbbFpaYLBNLqIXngcCrMIuThg_22RdBcUiOU5fC4orOUbU36Z9T2amaArmajcmKGR8wSXS8C2a66F9dvGJnq1xAc=

Remove freephotoslideshowmaker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.