home

freeslideshowmaker-cnet.exe

Free Slideshow Maker

Beijing Qingruan Chuangxiang Information Technology LLC.

The application freeslideshowmaker-cnet.exe, “Free Slideshow Maker Setup ” by Beijing Qingruan Chuangxiang Information Technology has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from software-files-a.cnet.com.
Publisher:
VisionGem Co., Ltd.   (signed by Beijing Qingruan Chuangxiang Information Technology LLC.)

Product:
Free Slideshow Maker

Description:
Free Slideshow Maker Setup

MD5:
fe775bc2b7250c38058bcd5a5af41c7b

SHA-1:
227eab77b6fcb050c7d177f265e8b595fe23261f

SHA-256:
738d8e379b6490cdfe969c5df0b18b140aa54e4429bd152cb773c3144f12e31d

Scanner detections:
6 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/23/2024 10:38:15 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.InstallCore.11
9.0.1.0268

herdProtect (fuzzy)
variant of freephotoslideshowmaker .exe
2015.9.25.16

Norman
InstallCore.CERT
11.20150925

Reason Heuristics
PUP.InstallCore.ENG (M)
16.2.29.23

Trend Micro House Call
Suspicious_GEN.F47V1201
7.2.268

VIPRE Antivirus
InstallCore
35322

File size:
5.8 MB (6,066,104 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freeslideshowmaker-cnet.exe

Digital Signature
Signed by:
Beijing Qingruan Chuangxiang Information Technology LLC.

Authority:
GlobalSign nv-sa

Valid from:
6/10/2015 4:42:40 AM

Valid to:
6/10/2016 4:42:40 AM

Subject:
CN=Beijing Qingruan Chuangxiang Information Technology LLC., O=Beijing Qingruan Chuangxiang Information Technology LLC., L=Beijing, S=Beijing, C=CN

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A617212A4CAEB593F360D25A7790A4EA

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:f5hljZfDx9M4O94WtC2FoBIN+DlHm25QogYeHagIPBpIyg9ddcvB6G46lS79sOcI:hBsgWtC2GWN+hVbgtIPgysgvL466OOcI

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9992

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freeslideshowmaker-cnet.exe has been seen being distributed by the following URL.

http://software-files-a.cnet.com/s/software/14/36/96/.../FreeSlideshowMaker-CNET.exe

Remove freeslideshowmaker-cnet.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.