home

installation.exe

Installation

The application installation.exe has been detected as a potentially unwanted program by 5 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from get.ddlmediaus1000.info.
Product:
Installation

Version:
1.9.3.0

MD5:
9dcc1e75116c998a7ce3398d17a50cff

SHA-1:
ee7a61e237cedcb9fb2bc24d100612607619e62e

SHA-256:
88a73d87589f94aa171e9f82e78eb3df1f36ef9aea68c587ab2ca7e087ef2d9e

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
12/26/2024 1:32:10 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-gen [Adw]
160518-2

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
8.0.319.0

McAfee
Program.Adware-OutBrowse.e
18.0.204.0

Norman
Application.Bundler.Outbrowse.BA
19.05.2016 01:04:49

Reason Heuristics
PUP.OutBrowse (M)
16.6.25.14

File size:
1.1 MB (1,126,058 bytes)

Product version:
1.9.3.0

Copyright:
Installation

Original file name:
Ionic.Zip-2015Feb23-011823-b5c0510d-45d4-4c7f-ab2f-22b31f8c1418.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installation.exe

File PE Metadata
Compilation timestamp:
2/22/2015 5:18:23 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:9bSaE4mvt/fz3YSiScfXv50Xt9fJwoRbYi9:9bSv4mv5z3Y+cn5MtFnR86

Entry address:
0x7604E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5931

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464.5 KB (475,648 bytes)

The file installation.exe has been seen being distributed by the following URL.

http://get.ddlmediaus1000.info/.../Get?p=13073&d=24601&l=1694&n=0&d1=NUMBER&clickid=sU10lHrfCa

Remove installation.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.