» internetexplorer_installer.exe
Overview
Analysis
File Details
Downloads (1)

internetexplorer_installer.exe

Software

Geryon Ads S.L.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application internetexplorer_installer.exe, “Software Setup ” by Geryon Ads S.L has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Internet Explorer but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Application (signed by Geryon Ads S.L.)

Product:

Software

Description:

Software Setup

MD5:

55888b44b0583fbc942199ce0982a058

SHA-1:

8d91d0cf3459b1d96944bf77c271543b8db3b02e

SHA-256:

fcd98826471b588fb0ff536c37dc623d5db78b6f6dd1fbcaba363d025d5c734f

Scanner detections:

16 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/24/2024 5:27:35 PM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.InstallCore

2015.03.22

Avira AntiVirus

Adware/InstallCore.A.2201

7.11.219.10

AVG

Generic

2016.0.3154

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.15331

Comodo Security

ApplicUnwnt

21595

Dr.Web

Trojan.InstallCore.151

9.0.1.090

ESET NOD32

Win32/InstallCore.XL potentially unwanted (variant)

9.11357

Fortinet FortiGate

Riskware/InstallCore

3/31/2015

G Data

Win32.Application.Agent.08MY3Y

15.3.25

herdProtect (fuzzy)

variant of icreinstall_firefox_installer.exe (Adware)

2015.7.5.8

K7 AntiVirus

Unwanted-Program

13.202.15339

McAfee

Artemis!2BF488E86639

5600.6810

Reason Heuristics

PUP.Installer.GeryonAds

15.3.31.11

Trend Micro House Call

TROJ_GEN.R00GC0OCJ15

7.2.90

Trend Micro

TROJ_GEN.R00GC0OCJ15

10.465.31

VIPRE Antivirus

InstallCore

38650

File size:

687.2 KB (703,672 bytes)

Product version:

2.7.6

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\internetexplorer_installer.exe

Digital Signature

Signed by:

Geryon Ads S.L.

Authority:

Thawte, Inc.

Valid from:

6/15/2014 8:00:00 PM

Valid to:

6/16/2015 7:59:59 PM

Subject:

CN=Geryon Ads S.L., OU=IT, O=Geryon Ads S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

71F910550D2DD2713679787B12FF2EA0

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:4AcGPuuMnymuky2nGmG98PpRvGA3yPT0Ieh5Wb9DEdhQdXtLMjACQ4ZPrw4R:4AcEquwGl98bvGCyPTGk9DpM0Kv

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.8723

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file internetexplorer_installer.exe has been seen being distributed by the following URL.

http://clk3down.com/.../ie_pa.php

Remove internetexplorer_installer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.