home

installer.exe

The executable installer.exe has been detected as malware by 12 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.bundlefilesstock.com.
MD5:
d6ab14e6433e35ee04b5c8ae0a6856dc

SHA-1:
6bbce29570b7111afa44b40b110422680543de4f

SHA-256:
d871aec55750821f6ba0aeb068884a65994e801d3c57df98998fb30d39e8fb91

Scanner detections:
12 / 68

Status:
Malware

Analysis date:
12/27/2024 1:17:46 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Kukacka
160126-1

AVG
Win32/Tanatos.T
2015.0.4489

Dr.Web
Trojan.Swizzor.19587
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality.OG
10.0.0.5366

ESET NOD32
Win32/Sality.NAU virus
7.0.302.0

F-Secure
Win32.Sality.OG
5.15.21

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.6144.0

Norman
Win32.Sality.OG
03.02.2016 10:30:35

Sophos
Virus 'Mal/Sality-B'
5.23

VIPRE Antivirus
Threat.416209
46938

File size:
400 KB (409,600 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\installer.exe

File PE Metadata
Compilation timestamp:
2/4/2016 2:08:58 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:J+fuos3iD45BpFvKSaVoQdyMU7GTAJMukr3KZn05yjjRbGVzJYT5Y2mf5PchENfu:ifD4FFvyWkn0JjKK05CkzmTcNceNK97

Entry address:
0x47190

Entry point:
60, 68, 18, 71, 6C, 0A, 6A, BD, E8, 03, 02, 00, 00, 81, F9, 5F, 10, 00, 00, BE, 3C, 0F, 96, 01, EB, 01, A6, F6, D8, 78, 23, 56, C6, C6, FF, 8D, 35, 7C, 4F, D6, 41, 88, F0, 0F, AC, CE, 9C, 59, C1, D6, 2C, FF, C6, 0F, BC, FE, 15, 2F, 36, 21, 60, BB, F1, F0, F3, EA, 81, C4, 01, 00, 00, 00, FE, CC, 81, C4, 01, 00, 00, 00, C1, F3, 91, 80, F8, 6F, 81, C4, 06, 00, 00, 00, 0F, C0, F1, D2, DC, 33, DB, 53, FF, 15, 18, E0, 44, 00, E8, A1, 01, 00, 00, E8, 12, 00, 00, 00, D1, 8C, CE, 18, 0B, CF, 66, 04, 1D, 82, 05, 0C...
 
[+]

Entropy:
7.7433  (probably packed)

Code size:
308 KB (315,392 bytes)

The file installer.exe has been seen being distributed by the following URL.

http://www.bundlefilesstock.com/.../installer.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.