home

global translatorinstaller.exe

Kopig

The application global translatorinstaller.exe, “Kopig Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Kopig

Description:
Kopig Setup

MD5:
eb28da223a633d0dfa07cef9f37c9dad

SHA-1:
400bfdf6ac36b2650134ae4c3138a30c45708cb3

SHA-256:
b9386b2f15bc412bf431c778e67cf68bc02d95bbe52d0ff1061d6753f9ec510b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/27/2024 2:28:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.3.9.17

File size:
1 MB (1,091,211 bytes)

Product version:
3.8.3

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\global translatorinstaller.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:7NXQHOUE8Vy1GTGYDlui0BGtdjNQRLMYjk2co+bQNiCs3qJfTKGY:7NAuUF7lu5+jNQRokFx+bQThep

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9096

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file global translatorinstaller.exe has been seen being distributed by the following 7 URLs.

http://www.conceptsgiftrepository.com/WVl6OTRQVEEzYlc1c2NETjVabWwxVldvMGRFcE1OWEpYVHpVelJrY3lORTlIZERCRE1XbEVVazlRV0ZGTGVIY2xNMFFtWXoxTGMybHhkelJrV0ZselpERldSMkpDU0dSRFdUbEVPV3BGU21kbFVUUkNORTlaUVdSUWFGVjRXWFJJWW5GTmJYRk5kRm93YkdneFdHWklWVzA0WTFaeU5pVXlRak5RZW5Kak0zSTNNVzlOT1RKMEpUSkdNME5FUlRVM2J5VXlRakJNUnpkbGFIZHJKVEpDWWpJMWNVRnRPR3RDVlRkWGFtWldaa2RoSlRKR1luZHhWWFJhVTBWYU5GSkRhU1V5UWpWT2FXOTBiakJaTUVWV1FWVmlNVmNsTWtaUlp5VXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFIYkc5aVlXd3JWSEpoYm5Oc1lYUnZja2x1YzNSaGJHeGxjaTVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VkSEpoWkhWalpXZHlZWFJwY3k1amIyMGxNa1prYjNkdWJHOWhaSE1sTWtaSGJHOWlZV3hVY21GdWMyeGhkRzl5VTJWMGRYQXVaWGhs

http://www.bestcleanshare.com/WVl6OTRQVTFCTVVSMWFIbE1iWFJQTVRKR1JVUnVZVTF4ZVVGWFZFZFhPV3RwWTBVeldqaENUVk5MYVdKUlJYTWxNMFFtWXoxYWMxRktVa0ZLWld3ek1XWlBTR2wyZGtwWVZsQkpSM1ExZDJWaFZtVldOREpGYkdsQ1UxaHJlV3BRV1ZkNVNXeEVhbTRsTWtKcFlWcE5OVlppU1VobmJuUXlWR3hYUjNVeVpFZHdUM1JEUzBrNE1FSk1NM0o2V1ZGU1lrOTJjalJFZFV4TWVuZFdUU1V5UmxJeVdUWndhbG9sTWtaM2VEbHpkM3BTZVdNME5rVldiME0xTlRsSU9XODJUR1J5U201TVprSnZjbVI1UlhKNVdXY2xNMFFsTTBRbVpUMHdKbVJ2ZDI1c2IyRmtRWE05UjJ4dlltRnNLMVJ5WVc1emJHRjBiM0pKYm5OMFlXeHNaWEl1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMblJ5WVdSMVkyVm5jbUYwYVhNdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR1IyeHZZbUZzVkhKaGJuTnNZWFJ2Y2xObGRIVndMbVY0WlE9PQ==

http://www.bestcleanshare.com/WVl6OTRQVTF2VFhwVlZXWlJRVFJ3WW5sNVlWVm9RVzVQZDBweWIxQklSVEozTTJ0SU9ISldVamdsTWtKSlduSmhVU1V6UkNaalBWaHRiMUJ0ZERsVGVVdDZSMlJ3SlRKR2FVbHphWE53UVRRNVEzWXhXV2RoVFVzbE1rSTVNV3hhVFRoU1drUjVWMnRrTUdzNWFrNVNXRmhHVDBOUUpUSkdOekZIY0VsU1dUaHZkM2RVVDNOMFJFZFhXbTl4UTBFMmJtaGxhR1JDTlZSNldFZFJkVmN4ZEdaaFJVWnVia3B4VnpVMU16aEtRbloxYm5OTk0xWmtXVXhyYUVJNGF6QTNZa3hRY1hoT1ZTVXlSalZMWXlVeVFsTTFhazFtWjNjbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSMnh2WW1Gc0sxUnlZVzV6YkdGMGIzSkpibk4wWVd4c1pYSXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xuUnlZV1IxWTJWbmNtRjBhWE11WTI5dEpUSkdaRzkzYm14dllXUnpKVEpHUjJ4dlltRnNWSEpoYm5Oc1lYUnZjbE5sZEhWd0xtVjRaUT09

http://www.bitsguardtoday.com/c?x=RnmxN6Li7m NZ3RzpJj4AA/YLHNP HQNFiz3z2WpCgM=&c=pZLQ1irOrvpVFhY66nSUsQlvYR/Zt7fodooI26Rz/1YMat9bY/x5vjlP1UHZu0h0/0hDZYXieI7MQ270cPSSCEFk/yJXuAfdD8QpCsonl7b8IRoZn8uAMaKgA2mvCkUR9dKLj 6GIpQHFW6JV3FuhkDCuU0kIB77NXSiVjteEtv 3sFtkLk2ihhDU8RLrz9&e=0&downloadAs=Global TranslatorInstaller.exe&fallback_url=http://www.traducegratis.com/.../GlobalTranslatorSetup.exe

http://www.bitsguardtoday.com/WVl6OTRQU1V5UW5wMU9HZDNORU5LY0ZkM1JEQnBNRXM0YzBKalMyRnJhamhZTm5oSU0wdzVSV3RIV0VneGJEUjBPQ1V6UkNaalBVOVNUVzVCY2s1MmNtTjBkM1pzTmlVeVFqRWxNa1p4ZG5sc1JuRkpaWGN3WkZGd1lrODVWa1YzVVRsR1YyOW1aak1sTWtadVdsSjFOM2RzYkZaTVFsTkZNWFZWVUZKTVNGVmxRMDF0VUU0MFJqRnpjR05CYUhWYWVWVWxNa1kzY1ZOTlprazVkR1ZFUWtsRlRWTmthMDlEZG05c1ZYbHFPVXBITkc0MUpUSkNUR2g1VURkYWVrMWlXRzFuWWxKbFMzaERKVEpHZWlVeVFraHdPRWRzZG5vMEpUSkNNbmNsTTBRbE0wUW1aVDB3Sm1SdmQyNXNiMkZrUVhNOVIyeHZZbUZzSzFSeVlXNXpiR0YwYjNKSmJuTjBZV3hzWlhJdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG5SeVlXUjFZMlZuY21GMGFYTXVZMjl0SlRKR1pHOTNibXh2WVdSekpUSkdSMnh2WW1Gc1ZISmhibk5zWVhSdmNsTmxkSFZ3TG1WNFpRPT0=

http://www.bitsguardtoday.com/c?x=F1C42sCxvwszRNYw9/xB2fUTIuLhDMo9FtSAcPlbp3U=&c=96AFmuGQ9yeQs 95V/yIpJXMEJjuofcDoAWCkpMeVEzbwKnXQc/b5HGmNVnStn3IsUX1elX92ZA3daRsjb8rxYoaGnbTHn8QY81P8F/yc25rhVbtkrnhcL8JFS66fmVqGCACY/YmPO6Hv5PWOgBrgFjGFOviKOOH 2kcKTV0mW32QQGzCbVdOcaRCgIIQRz&e=0&downloadAs=Global TranslatorInstaller.exe&fallback_url=http://www.traducegratis.com/.../GlobalTranslatorSetup.exe

http://www.bitsguardtoday.com/WVl6OTRQWGwxU1VKUU9YVnJZbnBLTWpJeVdHUTNkRGxoWTFSQlNrUldaQ1V5UWpCbk5XSkRjRmhzUzFGalprTllPQ1V6UkNaalBVUmxVVFJHZFROVVpWVWxNa0pyTlcxQ2JVRnZaRTR6UjJKRVRVMURVakJZVm5acVFrbHNWV0UxYkdoaGIyRnNaelE0WVdrMlZqQk1KVEpDZFdKc1dqZ3hXa04xUVU1SE5XZ3diVGR5TTBKSFZIQlBlRmRaZVhCak5tWkZPVWxZUjBSNU4zQnhTRGh5YlRsemEyVjBNMDlyT0NVeVFuWTNTa3BOTW5oeVMwNXhRekY2VDFCcUptUnZkMjVzYjJGa1FYTTlSMnh2WW1Gc0sxUnlZVzV6YkdGMGIzSkpibk4wWVd4c1pYSXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xuUnlZV1IxWTJWbmNtRjBhWE11WTI5dEpUSkdaRzkzYm14dllXUnpKVEpHUjJ4dlltRnNWSEpoYm5Oc1lYUnZjbE5sZEhWd0xtVjRaUT09

Remove global translatorinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.