» freesoundrecorder.exe
Overview
Analysis
File Details

freesoundrecorder.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freesoundrecorder.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Purek (signed by Huaxinwantong Beijing Technology Ltd)

Product:

Nopumalifo

Description:

Nopumalifo Setup

Version:

1.4.2.6

MD5:

62e31bef91d3c414deae464c05a14f70

SHA-1:

0c182d6bf672ed6d67a8b35a5b65512375f0807d

SHA-256:

787ab865cb185b040ec565d5c032822acd7df0bcff2d026810073259de08f565

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/27/2024 5:32:26 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

17.2.22.14

File size:

906.5 KB (928,248 bytes)

Product version:

2.0.9

Fast Software

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\programs\freesoundrecorder.exe

Digital Signature

Signed by:

Huaxinwantong Beijing Technology Ltd

Authority:

COMODO CA Limited

Valid from:

3/24/2016 7:00:00 AM

Valid to:

3/25/2017 6:59:59 AM

Subject:

CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C31292C6449E082B3FBF99E310243E2E

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0xA5F8

Entry point:

A0, D9, 31, 5A, 33, DB, 5E, 85, 85, 45, 6F, B2, 00, 7A, 3B, 8C, 77, 7D, BE, 22, 1E, 3D, C1, 91, 65, B8, 54, B2, 46, 77, 4A, 63, 2F, DD, 46, 7A, E0, CB, 6A, BE, C6, CA, 7D, CC, F2, 01, 82, 75, 85, EF, 85, FF, EC, 2B, 2D, 9E, AE, 0D, 6C, 8B, B2, 53, D9, 45, BC, AA, 32, C3, 08, AB, 4C, D1, BF, 11, E7, 4A, 6E, E8, 69, E2, B2, 29, 6F, 82, 5A, 6F, 71, AE, 33, CA, D1, A8, 0F, 48, C5, C9, 68, 94, 3F, CE, 8C, 74, FC, B2, D7, 78, 47, EB, F4, B2, 95, C8, 56, 77, 0B, 23, A2, 27, 7E, 85, 1A, 00, 50, F2, 01, 01, 00, 00... 
[+]

Entropy:

7.9357 (probably packed)

Code size:

39.5 KB (40,448 bytes)

Remove freesoundrecorder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.