home

installer_pit_format_sciagnij.exe

Debegarune

AGORA S.A.

The application installer_pit_format_sciagnij.exe, “Debegarune Setup ” by AGORA S.A has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.nowdeliveryvault.com and multiple other hosts.
Publisher:
Beseg   (signed by AGORA S.A.)

Product:
Debegarune

Description:
Debegarune Setup

MD5:
dca3f1ca18219cb67586d1efaf4df2a1

SHA-1:
a7256db2c4f18b8807fc3ea32d54be1056be4ae9

SHA-256:
71b0574d38dbe8c367da930eee0aa58a9da0396922de08def990e7cf83bfdcf6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 8:40:06 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AGORASA.Installer (M)
16.4.16.1

File size:
923.3 KB (945,416 bytes)

Product version:
1.0.3

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\installer_pit_format_sciagnij.exe

Digital Signature
Signed by:
AGORA S.A.

Authority:
Symantec Corporation

Valid from:
9/9/2015 2:00:00 AM

Valid to:
9/9/2016 1:59:59 AM

Subject:
CN=AGORA S.A., O=AGORA S.A., L=WARSZAWA, S=MAZOWIECKIE, C=PL

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
615B57E3504C929E3B64ED936D1CE68B

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QwcSeGbEsZPjsFsNgE0NqxzJVd74pgZnO0G0I0STS89EirLZfk:QPwPwiNOAzJ0GZnOAbSu8WirLNk

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file installer_pit_format_sciagnij.exe has been seen being distributed by the following 8 URLs.

http://www.nowdeliveryvault.com/c?x=r6UoW6HVM6Gl7GDreFWeg7god0SbjPO5FbP cKn1wiM=&c=aIHkpJ4RxUJKfuCzdt7ehJs/ZtOvmQbvOEitNOohAx0bYBDwNdN3lo8bKSaG4CXUF8yrJ3CSjbUqATDiJI Ga09IAoqx8kB96cdxD8Q7GhuKnX2mbVh3uNyVXwBXnh4fUdw1K/Gp0AldlxyQpXl3ow==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.contenthostworld.com/c?x=ATmJMFXTOnlcq0uWJHTPC/fm7t9mg5VgzVVk1TKfous=&c=FxvfPHHgqrBmWDuDfem5895F/nUh60n1M1T9odB35RbntGBLlvVL512TyzBbDZh3RaLG1QuxrhJuoxb8b9uKeKYJb4Q462HIpzh4Txn85bLmZV99 ImiJtfsIIaQXi3lCLVdjT8gREk4Ieu3 U9HVA==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.bitstownsigns.com/c?x=lXB43NeJimIRVjuRIMkRGwMMzfXSVBZuYtYP9em3W0U=&c=tExGg zyp9BklbEwSy oBXyKcuos9Gmfb/mLLcXVi6utuluwX QJiBvQZc6 t8Nd/xhWnsWvgXYBScurbE6dNIUiI8W7FD9EOzPQ7Ag8WvvBRj2inC5v8K5a55eukmYE&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.citypresentbulk.com/c?x=BmfT/NlJwndRapXUmdkjWva2Tci2NpstRd3LOKRVf3M=&c=6dYHVMdwAYTNTWFGVfW6Pv92fbHT4BZabNeWF EWZyiubfm1PO7ucjul0GfVTIhlTvam5kwOB0IEZMFKMMoG94IZpEsFNV9Etmv4/OkYciC6V41yWCc2cQVVGJ5CF IcTJ5kLMt3a0pub1PAfuf1Zg==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.guardconceptsbundle.com/c?x=7WFg0eCPsDcLKvRc7NQjBDu55LuW3iESmi/T75TYXyc=&c=whpnMPBzO/IjqzXxC6WQHxHqAcGbNeUxCN7C D9vEuMMTyiuAUtFyedvmahPfi/ygsavbIQQWgDUcoX nle5bUHpGzfu0aNr1XDfdmDK4qPSp2lvqfW6nB0DR4qRRyEVsfmdq0TzoXq3tweGTDUJAg==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.bestcapitalclean.com/c?x=hcKxc0PGcvLHHovl6E4ndN9RNAp3VX7hG guwJzI2KU=&c=cT5ENUEZ/dlOk/GvVeTyUenRBk9e6LC5uNc0jb6ZP6ECFWAkfTu7NdkhlMXVuW00jf8zkX9GMplzZov/2OvnKoxCXf2nTy72K4onEbmTnktsE4ruXkyiqSSsBfC6zGCk&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.filenewconecpt.com/c?x=L0QtVHA4J2z4Ow3t0DdOE8ijmOsb9hKgCZlTFPx1rm4=&c=4idoDULVDdZYsm6zLQcL7uES1r oBlSf6oYdfMUwJ8jnu9buOXb/xdsBKdrCGhbeH5xIcNz1HM4TB9kHSG30wBz3eOct AKEYXPZI0TvhM1fLQHizzVmsnEzCVEL8Vu0smXPCTHZ1Rm7e xGYdSDGA==&e=0&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

http://www.tourcentralbundle.com/c?x=6YhVtp koVzZ07AK8IZCHQd2kf9s XYpbTkU5SX2OCs=&c=ruW0eHolfU3yHS5w4GU6MHLx257etEXdV1w 3iEO6dYsrK7oioMD YyzkhrStz1OwZ 7/ME0NvdExDFUrY4clyiCUwheXCQ87m2GK2RdGL3ZMv/kcRbmd5Ltimjp5X2z&fallback_url=http://bi.sciagnij.pl/0/.../Instaluj_PIT_Format_2015.exe&downloadAs=installer_PIT_Format_sciagnij.exe

Remove installer_pit_format_sciagnij.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.