home

FreeVideoJoiner.exe

Fumenogane

Huaxinwantong Beijing Technology Ltd

The application FreeVideoJoiner.exe, “Fumenogane Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.applicationmegavault.com.
Publisher:
Fagenacag   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Fumenogane

Description:
Fumenogane Setup

MD5:
eb8bf1dff768373ca8e00c184a767b54

SHA-1:
f68ca272e2a4a87ed563b9cb9b14493552cb5540

SHA-256:
fafb87f1003b28d79ff5879ad55a7b16c1d5c269f3c82cb4a2c29fabac52a76b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/16/2024 12:44:28 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.8.10

File size:
908.6 KB (930,408 bytes)

Product version:
1.1.6

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\freevideojoiner.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/24/2016 1:00:00 AM

Valid to:
3/25/2017 12:59:59 AM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Mqjiz+JLooAe9aQojzwUGHmHXb5eA292Tl7un:xy+JLooAWajzmGHXb5eA292Tm

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9343

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file FreeVideoJoiner.exe has been seen being distributed by the following URL.

http://www.applicationmegavault.com/cCTGtdtCHsP_F5pTq0FxreJVDuX8zwOSY0akk8SybudYlFrUaWUa0_iQPMpf0aK8as0GlUAYF7pgZ25IO7zrti9Kh5yp40jBbKJoDgt7VmbmC6IYcKL4R918N1 zY2aJkbtbm9y4IdBMqyA6GkfBdGgxgFO9Z_YS98rR9nkPXZS6T_Mtjp9avY lS7nBHWhw ygWLxmNuIeEgtBqGT9Q8y2Xl9kIAxkd7npGfpk070VsuJO68IhtQwba5nXSr9VtYm0Yv5oSDRwhbRHw2OVrCoJkmQ7EQW5rWLE84lsTaJeJUjr3NsTyDNPGvbNouOkVv18o4VEEk2g1Tb2j3kplgI6PjUwAVjZDZ3FY0Cd2d vnQSEUOU1KsSoY6oA7GMHb5tOwBf6hR306f5YnZygJNH0vGAlGWLhzf6DHUGksfDmLe9qRhqD4W ebEU5wbKJRx5qxzJ6cEzQcvzVcDiLC8RsOdY9Z5A==-GyAAACRbyuRgIgfsbUnHg4eslD8YgW_M NihyXwXAw==

Remove FreeVideoJoiner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.