home

installation.exe

Setup

The application installation.exe has been detected as a potentially unwanted program by 3 anti-malware scanners. The file has been seen being downloaded from get.0119h.info.
Product:
Setup

Version:
1.9.3.0

MD5:
4274d39f1620b047ae9338d245f5c4b5

SHA-1:
6bfa76a44580b9dffcfef0afc1c1171d23fae212

SHA-256:
7f33c8b536ad4a54699d329ff80c843ef74624164516e498d79a85e7cd553c2b

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 10:59:15 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Adware AdPlugin.CUA
2015.0.4522

Clam AntiVirus
Win.Adware.Outbrowse-1251
0.98/21326

Reason Heuristics
PUP.Download.Bundler
16.2.15.23

File size:
532 KB (544,790 bytes)

Product version:
1.9.3.0

Copyright:
Setup

Original file name:
Ionic.Zip-2015Mar02-021305-a89fffc4-1c9d-4dd1-8f01-4153774da255.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installation.exe

File PE Metadata
Compilation timestamp:
3/1/2015 6:13:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:n6ziYJDMYhaatGtSV41OJDsTDDRI09e6RcxLV/EheN70h6BwJDsTDD1:nMiy4IadS4ms5I6e66fEheKhBst

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7478

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://get.0119h.info/.../1425262377/1425262377?41856289140Y2RsLTluNSgyLDEvJVw4LDIuMDgibDkxLCsuMR5lPCwmYDA1LCBxNURBT0JodF0hXWphWmplZDkyLF0xLildYCkwYTgxKC4yXi8sNDkvLyUxLDReLGEvOF0xXTAgZ1tmbTk1ImJkOGFjbCk0InplbzUt

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.