home

installer.exe

The executable installer.exe has been detected as malware by 3 anti-virus scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.hostbulkbundle.com and multiple other hosts.
MD5:
410c7228fc04e9fdff6a28650a6d253f

SHA-1:
4efb523599060ad1a56dfb565481035566a896f8

SHA-256:
6eb97783f567974eaff6526ee142da41e85087817504c7bc93cb9f23a7fb1557

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
12/27/2024 12:05:51 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.Swizzor.19586
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Mikey.31214
16.02.03

Norman
Gen:Variant.Mikey.31214
03.12.2014 13:20:04

File size:
312 KB (319,488 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\installer.exe

File PE Metadata
Compilation timestamp:
2/3/2016 8:46:26 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:o2y0Knkw2pMBYScnTFVgf5k6lRCx/k4gmR2vhEcqKbS4RarRh85:o2jGWIWvC5k6XC1kWUvhEl4ArRh85

Entry address:
0x3EC81

Entry point:
E8, 79, 1F, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 56, 8B, F1, C6, 46, 0C, 00, 85, C0, 75, 63, E8, 82, 1A, 00, 00, 89, 46, 08, 8B, 48, 6C, 89, 0E, 8B, 48, 68, 89, 4E, 04, 8B, 0E, 3B, 0D, E8, A7, 44, 00, 74, 12, 8B, 0D, A0, A5, 44, 00, 85, 48, 70, 75, 07, E8, A6, 29, 00, 00, 89, 06, 8B, 46, 04, 3B, 05, A8, A4, 44, 00, 74, 16, 8B, 46, 08, 8B, 0D, A0, A5, 44, 00, 85, 48, 70, 75, 08, E8, 05, 22, 00, 00, 89, 46, 04, 8B, 46, 08, F6, 40, 70, 02, 75, 14, 83, 48, 70, 02, C6, 46, 0C, 01, EB, 0A...
 
[+]

Entropy:
7.7158  (probably packed)

Code size:
278.5 KB (285,184 bytes)

The file installer.exe has been seen being distributed by the following 29 URLs.

http://www.hostbulkbundle.com/D13B7F12-B4F4-496A-8391-5556019050A5/FinalDownload/DownloadId-D0516C9E86857D13614C7C7945CBE045/D13B7F12-B4F4-496A-8391-5556019050A5/.../installer.exe

http://up.bav.baidu.com/?rh=4CAEA0A7F412103A094B2C3E2CA93C9F&baidusign=28455400&baidurand=4670

http://www.ranchsafesign.com/.../installer.exe

http://www.contentquicknow.com/.../installer.exe

http://www.megapackagetours.com/.../installer.exe

http://www.deliverybitsvaults.com/.../installer.exe

http://www.downloadsignfactory.com/.../installer.exe

http://www.quickcentralcenter.com/.../installer.exe

http://www.contentranchcurrent.com/.../installer.exe

http://www.flashapplicationsworld.com/.../installer.exe

http://www.newbundletour.com/.../installer.exe

http://www.giftdownloadscycle.com/.../installer.exe

http://www.cleannowclear.com/.../installer.exe

http://up.bav.baidu.com/?rh=AD031BAC1CF81F814C80C5CEA3A636FC&baidusign=28455400&baidurand=31931

http://www.updateheadbest.com/.../installer.exe

http://up.bav.baidu.com/?rh=3425F1A139EBE927C7DAC0FA92F7E3FC&baidusign=28455400&baidurand=29497

http://express-player.com/installer.exe

http://up.bav.baidu.com/?rh=3740EE2BC569A9824783A09CBD674F5E&baidusign=28455400&baidurand=1863

http://www.appfunapps.com/.../installer.exe

http://up.bav.baidu.com/?rh=5F4C58CEA285E022AD2C539EB5DBDB0F&baidusign=28455400&baidurand=32412

http://up.br.bav.baidu.com/?rh=50BD5BF14F23034B8C89D735B1E17383&baidusign=28455400&baidurand=32397

http://up.bav.baidu.com/?rh=6923983BCA2A81F18A532743EE8E24D5&baidusign=28455400&baidurand=12115

http://www.presentdlfun.com/.../installer.exe

http://up.bav.baidu.com/?rh=367340CCF809BF6AD8A0544A08D89236&baidusign=28455400&baidurand=16612

http://www.factoryhostshare.com/.../installer.exe

http://www.applicationsstockbundle.com/.../installer.exe

http://up.bav.baidu.com/?rh=CF4D134D717BA30EC049CC97864DBD23&baidusign=28455400&baidurand=16610

http://www.appstoursbinaries.com/.../installer.exe

http://www.hostbulkbundle.com/.../installer.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.