home

installer.exe

Application

Lite application

The executable installer.exe, “Application Setup ” has been detected as malware by 9 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.tabletopkeysn.com.
Publisher:
Lite application

Product:
Application

Description:
Application Setup

MD5:
7880e9a4124f7114531ee85fab1f473f

SHA-1:
cf1a2a86733136cbba1f0057ed955c2f2dc0ba34

SHA-256:
7881a5adb0bd850b2572add9f2b26ed329e33fb7d103ec42e88887a3e3982def

Scanner detections:
9 / 68

Status:
Malware

Analysis date:
11/24/2024 5:39:05 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Kukacka
160215-2

AVG
Win32/Sality
2015.0.4530

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.6304.0

VIPRE Antivirus
Threat.4721115
47240

File size:
621.1 KB (635,988 bytes)

Product version:
3.3.3

Copyright:
Web Lite

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer.exe

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:dHNnwsAi2YGgaKcBccvaPXNl9wQIPRl7q3C8pJth:dHN5AqGxVBcJXNvL8l7uh

Entry address:
0xA5F8

Entry point:
60, 87, FF, B2, 85, 89, F9, 80, FB, 7D, 0F, A4, C2, 09, 80, EF, 3F, 1B, EB, C7, C2, 01, A2, 78, 73, 69, C8, 48, E8, CD, 9F, E8, 75, 00, 00, 00, 48, C1, D9, 64, 4B, C1, CE, 88, 4E, F7, D1, 0F, C1, E8, 48, 0F, C8, D1, D6, D3, C5, 21, FE, C1, CD, 17, B8, 00, 00, 00, 00, 69, F3, 34, 88, 55, 23, 05, 44, A7, FD, FF, 87, F5, F7, DD, 1B, F3, 35, E2, 99, 00, 00, 87, ED, 0F, BB, DD, 91, 0F, CE, 81, C1, 8D, 2B, 03, 00, 0F, C0, E4, 0F, AF, C6, F6, C1, 3C, 8D, 39, 0F, B6, C7, 0F, B3, D6, 81, F7, AD, 28, 00, 00, 0F, AD...
 
[+]

Entropy:
7.8084  (probably packed)

Code size:
39.5 KB (40,448 bytes)

The file installer.exe has been seen being distributed by the following URL.

http://www.tabletopkeysn.com/.../installer.exe

Remove installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.