home

imgburn_setup.exe

Nasema

AgileMax (Alpha Criteria Ltd.)

The application imgburn_setup.exe, “Nasema Setup ” by AgileMax (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.currentsigncontent.com.
Publisher:
Kalema   (signed by AgileMax (Alpha Criteria Ltd.))

Product:
Nasema

Description:
Nasema Setup

Version:
2.8.2.6

MD5:
a706ef6c6b385b98cbfdfc78d1a42b47

SHA-1:
bfe7f74d04d10ae07692a5791bfe5aa3d2da164a

SHA-256:
8035288d2a6b721dadcd7691e7749d812758de1da5dec0c7c7878b57668e4972

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 2:58:09 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.5.30.8

File size:
937.9 KB (960,360 bytes)

Product version:
1.0.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\imgburn_setup.exe

Digital Signature
Signed by:
AgileMax (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 10:20:27 AM

Valid to:
9/2/2016 7:46:46 AM

Subject:
CN=AgileMax (Alpha Criteria Ltd.), O=AgileMax (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDBE79F75900E75EC6DA424D0A814FB0

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:SnUAjCZSiAZnaknV8+xsnSo/6HWgNlUgz5gxqus1d83OJmZZ7ON6:SUmISfZBxu6HWOOgz5Fu4d297OE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file imgburn_setup.exe has been seen being distributed by the following URL.

http://www.currentsigncontent.com/c?x=ZNt3xbuWKxZH5/VcVF7 8BNnI tBt6HB8I5W3k NIj4=&c=HyJPWy5e48mOD7hQ1JpLSH0M61iR5nSkPWaArG0aVSWWsMHjNKR0bpjeqp8m1jFwk1w8hOKuijInxn343nLnEnu1iiWBMOu6zJIeX10o 8k73xjuSJAhQI6ratRdUH9XkpL//P67IWZ3HZsA1TQltFIsg6yBYUnWRtdpmyvsAjxL8Zwie1/.../Sv8qdHPTe5&e=0&downloadAs=ImgBurn_Setup.exe

Remove imgburn_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.