installer_utorrent_dutch.exe

Free Software LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_utorrent_dutch.exe by Free Software has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the installCore installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from utorrent.toledareda.com.
Publisher:
Free Software LLC  (signed and verified)

MD5:
bb9d0164e48be5a3a5a6356cfbefab79

SHA-1:
7ef700ec8fac7908ea24053a29862632ec008c73

SHA-256:
698601b90d1f617475eaa70d620b79796cd44dca4d0e35632d7a144d14961de9

Scanner detections:
15 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/25/2024 12:23:13 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
7.11.214.92

AVG
Generic
2016.0.3178

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.1536

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.DownLoad3.35287
9.0.1.065

ESET NOD32
Win32/InstallCore.SC potentially unwanted application
9.7.0.302.0

F-Prot
W32/InstallCore.AG.gen
v6.4.7.1.166

K7 AntiVirus
Trojan
13.204.16003

Malwarebytes
PUP.Optional.BundleInstaller
v2015.03.06.01

NANO AntiVirus
Riskware.Win32.InstallCore.dnqbyw
0.30.24.1636

Reason Heuristics
PUP.Installer.FreeSoftware
15.3.6.13

Total Defense
Win32/Tnega.CCFOBXC
37.1.62.1

VIPRE Antivirus
Threat.4782551
40432

File size:
793.5 KB (812,592 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\installer_utorrent_dutch.exe

Digital Signature
Authority:
Starfield Technologies, Inc.

Valid from:
8/1/2014 12:08:01 PM

Valid to:
7/22/2015 1:23:49 PM

Subject:
CN=Free Software LLC, O=Free Software LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27DD6AADCC34E6

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UKFTIENy3+ZSijrkfj0NF3I1zG8gnqZuDUYp799Sp:UYUrijrkfjOF41hgq4UYD8

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_utorrent_dutch.exe has been seen being distributed by the following URL.

Remove installer_utorrent_dutch.exe - Powered by Reason Core Security