» installation.exe
Overview
Analysis
File Details
Downloads (10)

installation.exe

Mari Mara

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application installation.exe by Mari Mara has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from i9pumg.dm2303.livefilestore.com and multiple other hosts.

File name:

installation.exe

Publisher:

Mari Mara (signed and verified)

MD5:

ee3bcd9ec7be651267b2b82991284504

SHA-1:

4e1098ff3f52ab86471345219d74c8203f51b008

SHA-256:

9d063d5e2b12b86eb56436bab838c8b82164e28df4b491994f714a120c9e9d0d

Scanner detections:

14 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/23/2024 10:26:14 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.OutBrowse

2014.11.29

AVG

Downloader

2015.0.3276

Baidu Antivirus

PUA.Win32.OutBrowse

4.0.3.141129

Dr.Web

Trojan.OutBrowse.14

9.0.1.0333

ESET NOD32

Win32/OutBrowse.BJ (variant)

8.10797

Fortinet FortiGate

Riskware/OutBrowse

11/29/2014

K7 AntiVirus

Unwanted-Program

13.186.14174

Malwarebytes

PUP.Optional.OutBrowse

v2014.11.29.01

McAfee

Artemis!EE3BCD9EC7BE

5600.6932

Panda Antivirus

Trj/CI.A

14.11.29.01

Reason Heuristics

PUP.MariMara.M

14.11.29.1

Trend Micro House Call

TROJ_SPNV.03KP14

7.2.333

Trend Micro

TROJ_SPNV.03KP14

10.465.29

VIPRE Antivirus

OutBrowse

35220

File size:

562.1 KB (575,584 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OutBrowse Revenyou (using Nullsoft Install System)

Common path:

C:\users\{user}\downloads\installation.exe

Digital Signature

Signed by:

Mari Mara

Authority:

GlobalSign nv-sa

Valid from:

11/11/2014 10:10:16 AM

Valid to:

11/12/2015 10:10:16 AM

Subject:

CN=Mari Mara, O=Mari Mara, L=Dublin, C=IE

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112167C220B9C5568C1F2BDF4D04BEE1E24C

File PE Metadata

Compilation timestamp:

12/5/2009 11:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:0nMeuT2aDPTKYlQne1PYfA3psEGZB2o/dZeAKj/yfJW//zaWxoH:0naKaD+YlQexY4cB2o/dEj8w//zaW2

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file installation.exe has been seen being distributed by the following 10 URLs.

https://i9pumg.dm2303.livefilestore.com/.../Installation.exe

http://bit.ly/1zz9uD1?cc=14a2eaa81c6e772473e428801d165ac6

https://i9pumg.dm2303.livefilestore.com/.../Installation.exe

https://onedrive.live.com/download?resid=9E2259112F063BAE!106

https://doc-00-8c-docs.googleusercontent.com/docs/securesc/jdilkcp8n83cac0pv3qmp74bh4u7fl8l/6fal704f8uc1f5adfu64q6ocliuufsl2/1421928000000/02389099468332117340/.../0BwElGBuh7RFGa1F6ckh3cVVrU3c?e=download

http://bit.ly/1zu79dZ

http://1drv.ms/1zz9uD1

Remove installation.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.