home

installation.exe

Safe Store btw

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application installation.exe by Safe Store btw has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from dl.downloaddesktop3.com.
Publisher:
Safe Store btw  (signed and verified)

MD5:
6bef2f12d937222a2b7f4f6806e225a5

SHA-1:
cf3a430c24370e0d5baa214f89107f1107f462cd

SHA-256:
c2aefa165d97e695729e1435237e740f056863885d69f4bb6a6ba1afb0edc9fa

Scanner detections:
24 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
1/11/2025 11:40:41 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Outbrowse.1
6463993

Agnitum Outpost
PUA.Downloader
7.1.1

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.02.22

Avira AntiVirus
APPL/Downloader.Gen
7.11.211.248

avast!
OutBrowse-EE [PUP]
150101-1

AVG
Downloader
2016.0.3191

Bitdefender
Gen:Variant.Application.Bundler.Outbrowse.1
1.0.20.260

Dr.Web
infected with Trojan.OutBrowse.83
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Outbrowse
9.0.0.4799

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
2/21/2015

F-Secure
Gen:Variant.Application.Bundler
11.2015-21-02_7

G Data
Gen:Variant.Application.Bundler.Outbrowse
15.2.25

K7 AntiVirus
Trojan
13.197.15042

Kaspersky
not-a-virus:Downloader.NSIS.OutBrowse
15.0.0.543

Malwarebytes
PUP.Optional.OutBrowse
v2015.02.21.03

McAfee
Program.Adware-OutBrowse.e
16.8.708.2

MicroWorld eScan
Gen:Variant.Application.Bundler.Outbrowse.1
16.0.0.156

NANO AntiVirus
Trojan.Win32.OutBrowse.dnmhre
0.30.0.296

Reason Heuristics
PUP.Bundler.Outbrowse
15.3.18.1

Trend Micro House Call
TROJ_GE.8F191241
7.2.52

Trend Micro
TROJ_GE.8F191241
10.465.21

Vba32 AntiVirus
Downloader.OutBrowse
3.12.26.3

VIPRE Antivirus
Threat.4150696
37588

File size:
589.3 KB (603,392 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou (using Nullsoft Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installation.exe

Digital Signature
Signed by:
Safe Store btw

Authority:
thawte, Inc.

Valid from:
1/26/2015 7:00:00 PM

Valid to:
1/27/2016 6:59:59 PM

Subject:
CN=Safe Store btw, O=Safe Store btw, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
4B03208434AFAEC746680360D83D2263

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:K8IBdxmQCf4hI6oToDgRB+nREm89S5PUfbdRtsUIh6tuBt:K8IB+LghIhoK4AwKKUuwu

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9617

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://dl.downloaddesktop3.com/.../get66?p=13013&d=24749&l=24044&n=0&d1=1&s=ww-flop-tbpch&clickid=9fab96a5-792b-4a42-a864-953179de61eb

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.