home

installation.exe

BOXi DJv

The application installation.exe by BOXi DJv has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from getm.0108box.info.
Publisher:
BOXi DJv  (signed and verified)

MD5:
28096ec3f27bb5845838b0930e2583fe

SHA-1:
bcd464d5252331282ccb712acfeed795c59be119

SHA-256:
27c4969292037fe7576ed3061cf06b23ecf5f59d591b684c69a52890bf4f0300

Scanner detections:
24 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
12/26/2024 1:59:46 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Outbrowse.1
660

Agnitum Outpost
PUA.OutBrowse
7.1.1

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.04.16

avast!
OutBrowse-CT [PUP]
150414-0

AVG
Potentially harmful program Downloader
2016.0.3138

Bitdefender
Gen:Variant.Application.Bundler.Outbrowse.1
1.0.20.525

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.OutBrowse.265
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Outbrowse
8.15.04.15.07

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
4/15/2015

F-Secure
Gen:Variant.Application.Bundler
11.2015-15-04_4

G Data
Gen:Variant.Application.Bundler.Outbrowse
15.4.25

herdProtect (fuzzy)
variant of unconfirmed 441822.crdownload (Adware)
2015.7.17.10

K7 AntiVirus
Trojan
13.197.15033

McAfee
Artemis!1DCA01412E8B
5600.6794

MicroWorld eScan
Gen:Variant.Application.Bundler.Outbrowse.1
16.0.0.315

NANO AntiVirus
Trojan.Win32.OutBrowse.dnpjkd
0.30.0.126

Quick Heal
Adware.NSIS.OutBrowse.A
4.15.14.00

Reason Heuristics
Threat.Outbrowse.Installer.Outborwse
15.4.15.15

Sophos
Generic PUA JE
4.98

Trend Micro House Call
Suspici.BD67879B
7.2.105

Vba32 AntiVirus
AdWare.OutBrowse
3.12.26.3

VIPRE Antivirus
Threat.4150696
36694

File size:
606.5 KB (621,080 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installation.exe

Digital Signature
Signed by:
BOXi DJv

Authority:
thawte, Inc.

Valid from:
2/4/2015 4:00:00 PM

Valid to:
12/17/2015 3:59:59 PM

Subject:
CN=BOXi DJv, O=BOXi DJv, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
03D318B5AF7A892C6C361FEC826536B8

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:4GLXH9rd+zmOFGxOOBDEHxyblpJj+9DfUAuQ1N:4Gr174OFEQJSaAuo

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9463

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://getm.0108box.info/.../1423554956/get26?91533134266ZzwsMC0wMCJiNywrNi82I2s6LjIqLislaTotJWEtOysgajxoZSpibWkrb2RnMSFgaWhgZ2deNy9jYDFhMzZhKy9fKWQoMWNiYylgMS8uLDA0MjEzMS8uLi40LCNmYmxqOy8gamdgaWk8Lg

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.