home

installer_directx_11_sciagnij.exe

Funusikem

AGORA S.A.

The application installer_directx_11_sciagnij.exe, “Funusikem Setup ” by AGORA S.A has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.hostbundlecapital.com and multiple other hosts.
Publisher:
AGORA S.A.  (signed and verified)

Product:
Funusikem

Description:
Funusikem Setup

Version:
2.8.2.3

MD5:
e7a49df9d989c4fbc310a2a76df72613

SHA-1:
17bb8e798dcd04a93e52955640f65f31f022e10a

SHA-256:
9d63b8de76b1b74b18d5185f68c37280faf4a002670037429991bc7b215c9996

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
9/29/2024 8:28:19 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AGORASA.Installer (M)
16.5.5.2

File size:
934.7 KB (957,176 bytes)

Product version:
1.4.6

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\installer_directx_11_sciagnij.exe

Digital Signature
Signed by:
AGORA S.A.

Authority:
Symantec Corporation

Valid from:
9/9/2015 2:00:00 AM

Valid to:
9/9/2016 1:59:59 AM

Subject:
CN=AGORA S.A., O=AGORA S.A., L=WARSZAWA, S=MAZOWIECKIE, C=PL

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
615B57E3504C929E3B64ED936D1CE68B

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:D3mdjVK18l5wmIr/dcFOEw6NUyZOYBwBCoHH0elc:DWZV7Ir1ei66aUBVvc

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_directx_11_sciagnij.exe has been seen being distributed by the following 14 URLs.

http://www.hostbundlecapital.com/c?x=JFcp7y0Jbn3RChE44jCM1NA0YKecj3mEzWzF/DrH1Vg=&c=OWrr7GFWGwE96IVchFnWDYp fgz8WX8We38kFf/BE24 apqzeKm5XguJqQ3jwx0AGFSL2mwNb6dww3b5urtT89NaKsIsSlns/VUY2vuSLmfAEcScnniDN9pxqwucHi1Y&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.vaultscontenthead.com/c?x=eWXndW9lF/mWGgN87wdk8senLwq55 LorUhWfS6xgz0=&c=jPFVk4NJdeni14oJDnTEVDWShsIZdpAG8lVoXI7tQjN8JEM7jmqXuE/CV2OhmQaRL/sVs5YerNtdc2Ytav4nabIdOFcqtjpAdRpAstotfxHxld3 tCk4cSomYyhFieMe&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.hostbundlecapital.com/c?x=msHC8CynUD/Jyyhd8O8vMEam0poucJ8Vm9mRyyYQ1cA=&c=btmdcxMFwq/rbgLzqvkimcHeR d9PxMOFoBmkokcdQmwYJfvTG94TtHpwKsDg6v4kHmw5Mx5Qu55dPkF2tBAGJb/ FF3L8uT1uYYr /dUZhMUc/uyC73Dp6TwnCsPv2V&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.worldapplicationcity.com/c?x=UV23udo17RkCKffWPOcu8KSaU86u5g1fSs2iCM/jcVc=&c=mAGNZQyruluZktiklSnbZFlb5wyc9kLuMFnQ8b1U3czIJUTPnWV1afcRGSj4plB9JsWh5rz60GtSVgxB6Gt/r1CANaT0PP9LEjoiWYmvDM BRnrh7SEY3MC4rNqLupt2ewpAt1 IQpZwC/CsjzUXRQ==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.hostingcontentconcepts.com/c?x=cFmsPr99KtBAC5l2Vu3SDxRli3cEOCWQf0vX7hCpQlo=&c=UiEZlLx1RRuz/jCmm36OgjXZXwyPxBIt3gjwiCayv/XO5NSSWTN96lC4cvRU7HEwTDPpRmhbFD2qNQX/KDyVtVtZajeBKZttdboNLPJmzwAOc0l1BwvQSme3ui0Zjw7lz/RC4GBdbwGtM0yqhxSiTQ==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.universecleancenter.com/c?x=sa/PcbDE8OnhEJJS336Cg9swB1a2bk0zzk8c35OnO78=&c=R7lNckZJYrH5EgmJWjzSDnDdl O1XeZynr2KhTpwP4HGFkplly/VKlU R6p7xO23VrRcpa38u7TMxu4cApckASLEnwDn2e3nRuXeVfHGvEvsYi9akF/Bzl8hUFqMSwtE&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.hostcapitalhosting.com/c?x=IjvmZDgpNFCvoLJbQ/O8h2RrOtSjJQuTRt4ycsKCzpk=&c=aiPBMr1VOO0tlIhS2oHMK7r2eio5PB8fbSppC/0NOkQsWr/MoZFcJK2g6NGqCNuRmg9JnJ0aqoljoLRuR5mn68NanngFC2fvl1LIQB6T/XQ1Ibk79 8efd78kK7u8mWO&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.tourstockheart.com/c?x=Dn9Z/QCatQWiHdsqFuYuj 9Rtf1X1bBkn9ORgmCWn04=&c=QIkZCACOXZoL9VsQ UmO7Kjz4ImrhaYZhaV6/7rey6bOOWEHz7c68DZfc/uyCInyk3Nb8PIicBj/e3xPVIPOoq7CQneD6UGmvl8zlbNuSvDqlePe0/90VC9cv6t0yWGW&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.guardranchapplications.com/c?x=2dxW WeJDy4ubv9H3/MHtDLV7ZWpdqi0vzmPvV5BTKA=&c=i3lG2J7pMAINhlmE3wJmapEWRRMwYgQC3veDlMXi6BORGVRGCtLU1Z WHi 6RAB3xei6p7OtR4aOufpOzwmjtFyoIHIuP6CWa0uUwnjO9l0rzI NGko1VNVvQkpbfHniQDK67j4/Kma0oFYVEbaVgg==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.townuniversepresent.com/c?x=Ok cq5l9JqiPHz4xd35pS3rdLnBAMMXvFhtTkoV0J/k=&c=iKT4AYWky176/zp1lgS/8BnqzhPOeNZ6kETKNJeRCSy9mFrpAd9Oyr9CpmdfSlVngqL24Rqe6OP84gCM6fvyEIfc8C7bpPDiOIXliiztU9b xLfbJ16utHW9cKByrsayJZQaT/gu9Gh0NW85dqO5gg==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.vaultscontenthead.com/c?x=4jfiztsQ1kSNITBkyN8sZDAIh tIUffvgtTlRxIWgqU=&c=Qr VyeO71 /Ggnt157NOaaAlr4dP6tJ/n5q5wK/pmoMLY13NN8oRboPDckkHU1ecD9YQy5dHNEyRZSzLPgOwo1z oViqxqw2q nBriA0rCEeIwwVoHSjzoNQyTAWHNgs&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.applicationcleanbulk.com/c?x=fmAMCVdfX8yKnAVTaFIympnbzqmDFmGXohjLOhmu88c=&c=jQBX9HEVnn1ZKHvyRrd3V5zLVOMAsQa0M2m /hTFU0R/m7VCIDw3FpVLOEvteQARZpdP/kOmYcbWvUXEA0S7jqcUajKnl/MjjzaT0Ip5TJtWT3B11RmxSywDzKS43GFqJEGTbY12de0 4QYt0CT8Gg==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.downloadstoursquick.com/c?x=v/ykmGin1pKkFhEpGk7c56 lrcKa7VCCBx0f5LIZ6Bw=&c=Ksf6evgw5oX4JpC9VoG05ybsTa2fRci6KMIYPCYfjJSXVbXdBicpj9kr9UYFEMLJDLFylGkyrFbLhYGWm2AlbVpQC3tXZ6r6n FhD3w5G3XzHuXAy100uI4XBhDeKHDHAiGrQQjokBGk5UCDF6Gd0A==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

http://www.guardranchapplications.com/c?x=ddUQWU7nzGdzgDsLNDHm/j/5j6Cyq2FUV79jvx3QsQY=&c=LBUdtEsJ0JvMaEWYTv699lU3MJXPK212DJsKZaE6nb92JFgJ8B Y2jNXpyNozSYjZSDaszjgdcd/FnhhbeOyIyjt6VwPde1xqlV6WNhl9Qv2AYORgwG/3EYuR W2d6GdE2wRiiL/4BSZu9ppEzCOFQ==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../dxwebsetup.exe&downloadAs=installer_DirectX_11_sciagnij.exe

Remove installer_directx_11_sciagnij.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.