home

installation.exe

Installation

TOV Osya-Trans

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application installation.exe by TOV Osya-Trans has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the OutBrowse Revenyou installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs.
Publisher:
TOV Osya-Trans  (signed and verified)

Product:
Installation

Version:
1.9.3.0

MD5:
2b5dad05c86173aaa997b8c27bcbb72e

SHA-1:
e5ccb59671fb3c4e6f5b814334b7e7f81888766d

SHA-256:
8595f0167ad397d1ece1a86f194bf126bf271288854a4de0690167f17a21fda9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 1:45:16 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OutBrowse.TOVOsyaTrans.Bundler (M)
16.2.12.13

File size:
1.1 MB (1,129,280 bytes)

Product version:
1.9.3.0

Copyright:
Installation

Original file name:
Ionic.Zip-2015Feb25-141415-af689c21-9b51-47ed-880a-fc136bc9574f.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installation.exe

Digital Signature
Signed by:
TOV Osya-Trans

Authority:
thawte, Inc.

Valid from:
12/29/2014 1:00:00 AM

Valid to:
12/30/2015 12:59:59 AM

Subject:
CN=TOV Osya-Trans, O=TOV Osya-Trans, L=Uzhgorod, S=Uzhgorod, C=UA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
728BC5572A0DA8EBD677D0A17C4B5124

File PE Metadata
Compilation timestamp:
2/25/2015 3:14:15 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:hMiy4IadS4ms5I6e66fEheKhosNZ4VW2n1bX5PBGWdVHwuJqUhxEJ/t3su8zLYzJ:hbSaE4mvt/hsitnpBVE8xIcXYIMMMt

Entry address:
0x75F5E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://get.0106life.info/.../1424873641/1424873641?02569765201Z2NvLio4ajgvMy83MSFeNCsuMzU3JWw7Li0pLiBpOzAlZC84SExGPEBQJmJsZ15lYF03RHQxL2FuaWI8XiBkYW9tPTMhdGBpNy0kY2s9ZWBuKS4

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.