home

iheartradio_downloader.exe

Tucokiragu

File Validated

This is the InstallMetrix bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application iheartradio_downloader.exe, “Tucokiragu Setup ” by File Validated has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the InstallMetrix Software installer.
Publisher:
File Validated  (signed and verified)

Product:
Tucokiragu

Description:
Tucokiragu Setup

Version:
5.6.5.6

MD5:
5084b971cfb7bf6189d0b3611dc58038

SHA-1:
92fb80b9a2dd8f18f254739cf0ca70ca55d4e4e5

SHA-256:
f570bbffc1e9fe358e05ac566d11644dbf157898858a875cb8ffe1e12f8dcf2e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 6:27:37 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallMetrix (M)
16.8.10.10

File size:
933.5 KB (955,904 bytes)

Product version:
2.5.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallMetrix Software (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\iheartradio_downloader.exe

Digital Signature
Signed by:
File Validated

Authority:
GlobalSign nv-sa

Valid from:
2/2/2016 3:33:01 AM

Valid to:
2/2/2017 3:33:01 AM

Subject:
CN=File Validated, O=File Validated, L=San Francisco, S=CA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112127B04ABA745F034A3BB2B235BBD0A1E4

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5+QypRuT+ElDwQuxkwMopm9kMNp8PV0fslvcAb+Hy:5l1T+EldDBo8rNp8PV0fseAz

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9338

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file iheartradio_downloader.exe has been seen being distributed by the following 2 URLs.

http://www.vaultsconceptsapps.com/lMvJkJMaU4QyVwST3eqXHrBJGZ77J hG4JeAPygEZMHU3ITGYP7zIHuR1ZibL8zij7ptJsOM3Sgu68hsmeI0UV5a1Zp5spn2Y3A cR_PERJNGoznx1IhGCqS4OvgGkGF8lKkCVARsqaYM QwRiOhaFLMv 3792gLdSKahPJzf_ym0kTCl rA3TJV3NNIIbMo9k6MRKPzJzRfLwSGWx7CsVuASggAGh8JABOh6nikQv9AXgRSjSk3iZC8fl2Bw6HYIn3076A0dxbfdDtODloN5geS6yYZxeDtm8FuVk2HMjG j2BMgyyvChfeZ6zFuL595wAn9Ji0uouHdd64mlooMnzMKrGXOLkMkOLH5pcko1eefYvavpywb4vZovRoYV_Fs0dPdW6z5v4vDa43do6uAr3qomty5 yfzJ 46QoB_RAWBvzOcjKUlGwJzNHQ4K8P9MlcWcmbXOKE2qODYw6vGzPiCA1hxMuaOx_V4fKOAwRV8nNlrrSlP4Hehxv8zWTLCXqIFPad97GMY4oQDKFM2K9U7FU26DGAUkED_oF87p3NNIt8EHoIoTI_Wfrt4RIvwmbjKQAQur6UOiV0VSBXSzZtU3bSiQ==-GyoAAMQuF5svWSAJxQko5rZ1IZLMopDGNg_Ejbt9TzoBxFoOet4HC6tFUQ8=

http://www.vaultsconceptsapps.com/XcqAN_fUc9pQc36VZpHF_gAhXom_mC9jRNgmQP My4SD1VvubcT_G_eff8gOBeiKZBn8QcZjP6xAMelw330xo4UT3IUcNhDvaLh_7 pGlHgNPUA4s5XdNM rcYH_rI 85XzHO80HZb4O XD0y9Bv0yRQFfIKZIlwAhW8a9c4MrLffC98DjjnorCc9nuvbPZN8r91z1lMMA hfAvCfORRKa4XrT2ekQ9cYeYOLAqft839w bwn30CEjFIxTmnEXsK2QopmI2e0Zu_ajLsqWGNRDiQUzBW4ZJwQLmsdLrFTVTfbHIegTIR1tDIvJ0hzPmH3DOluBrxRFwAVwYMsHmR5mp d h2gpe9CZFa5w8Ozngz2arvKAhc6Yh21ZgkurThwpQoX273UXjmBtjxwNS8 ZwCqjnZv2w qWHmcj95s9NCMBmN2 u4rvWaY tPZ3XaCQjA2CDhOZEx2cgh nkg5I23LXPK1Vofvk1YkDjQ4ym _IZOApxN BKOq3aAguY0GSpagvG2Tl6JgUxpYAY7jLZCIU8GAjAp8a88vLnAc4NPrz 3ZzNb6FUrweyueCU_lIWn1oAkee2WySPy SFmmsK9yZGDQg==-GyoAAMQuF5svWSAJxQko5rZ1IZLMopDGNg_Ejbt9TzoBxFoOet4HC6tFUQ8=

Remove iheartradio_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.