home

java_update.exe

Software

GERYON ADS SL.

The file java_update.exe, “Software Setup ” by GERYON ADS SL has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.signappcurrent.com and multiple other hosts.
Publisher:
Software Application   (signed by GERYON ADS SL.)

Product:
Software

Description:
Software Setup

Version:
3.0.2.4

MD5:
497604b6a17a9f1aff1300971021120b

SHA-1:
b413d98415c46732e547242691dbab2139ae963d

SHA-256:
771b19c3a3786923ee740f8b09997332ddccff5f44bc8ee3b69a38acb771406d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/25/2024 7:52:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.GERYONADS.Installer (M)
16.2.8.21

File size:
944.4 KB (967,040 bytes)

Product version:
1.1

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\java_update.exe.duphe4q.partial

Digital Signature
Signed by:
GERYON ADS SL.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 8:21:05 AM

Valid to:
6/23/2016 7:17:17 AM

Subject:
CN=GERYON ADS SL., O=GERYON ADS SL., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112181D069E2BE8A14952BA745AD05847F6F

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:fjdn2YA41uLBZ7CdHkIQzIOxoFZmW6p3kyPzkDRM/9ABzlmavm0:fpnG+uLD7CdHwIDj6p3kCkg

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9370

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file java_update.exe has been seen being distributed by the following 10 URLs.

http://www.signappcurrent.com/c?x=6aQisDB1LwxEcMAoiXLidX21CQpcgy/Pp sv0IoNDt4=&c=FsNWC7MRn7a XjAcRQBgtjlraU7KnSGobQAKigmubLnV4oiImAFcG6EouwtZ6N76MP8UAAAL6yF45LhV8xco1rvLW9snGXK8cudgq/FramfFjrbkiIOzY3/ZFDnfVbGi&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signappcurrent.com/c?x=yuwHCftZGP8jWvNIvSt2msQ/m0kr6yjloAXDDkUuDMI=&c=KYg/j644Ef9NMjhCsshNyAwxkCaQK/egnlriG4YjqudbZFHGyy 2x h23n94WcKVwEOultOKc/hc82cI/WucgIT3/uJAYUyV62 3LOcXPF1y9yhWZzwxALZkl/ocrbWs&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=rCHrEC9mf7V0c 3lcXgngdsgP7OYWeG3Qpu/tnYIakU=&c=LV3P5ZOdMO85VQbYWSmY3Tk/AwSpdqspnKvW84TWuPyOThZhfLGQw KI nd/oj4QLgKE5E4NnQ6Vs tpE9aLz 87Htnu/IG94bjupjty2p9MbEHN1O0ZzRQthtg6kI/p&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=SsCpYI8B3mwoIRj96hCMrD2TiQiqSd5txbmrbPGkKQE=&c=E95tLc7cY25aHB4Erpca3 gDGwl3JC/RV ntXUkji1ZCQFeCeoR5gCk4gRa8mOEHrvRmkZ3MrqYEp7jW33O3SjRLmiWTeBRSD0xwMycCUfjhaLyb/UdlsAzKsurqiljM&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=pft31anX6TM1YZ0Wz 7HqEfVNzalYaLB 0WD7Kjahi0=&c=w2FTsy E4RMnU2kpX p ri TyHsFNwPBgzNoLbW8kez7uYDX 7erImw1dHWAgfkXBkNs2fvFO2DAhkbmlRmQ TmfcCVq fNzYSgDTz46SkAPnu7eVfVBDd O93exjJQN&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=o rBRQ 9jbLuC0I tkyNDW9sYHGV27iCPkEMivnN4DU=&c=PCY10J1K2RJykw/4hlZ phW/4ih5VVr4kIarrr/owTshnBm3Y1UI28tpZm/uv0 KegfcptcLQodalTkxCwkSoVGKrWNQ8WhxYKl3e19J3zcSBLxbfMIxY2nlMyJvPB/Z&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=xzL25F3vpsl60G7lDh5gggMUo/eWDZ9dQNHu/4QbhBY=&c=kJG2HeI fQgnf1BRc6RgVYdh8h5N7kk3D8YiMTobyGTR2h6s5suZf7cG5hG23 TA4B7L6Fqk6gAkZMt3PmKVNLZgAPTwVDU16VwJ3CSc1A3kiivwXu2v 1hvXLYWf5uv&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=aV6kF6vmAX7fQcn WakZ Apzz5qA8BVXfoi0YyiJZ9U=&c=mOnPnp9 a y5hlWJH HyAb5J2iomDUn0X81x0/va3aAwA/5TiswVlKFPGuw8UsSPKokhZGC1PHvBFkC/EPcOHv/hFZHff Z 3IpAD69vEHQTwTW0lMCQUMZy2Nafi8eS&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signappcurrent.com/c?x=TOj/sIGIZpyjF3PniXmNEbsIhF53Jx/Msv6dnCYOe84=&c=fOAfbhtAr8XUTAdh9idv3d6Fb4/yYmHU0e8lE5caZMHtjUacZ CKRfowxmczUHdMmtZE19phS7YU A7//ZjGfjEMqg KzrsXeV5tfGUe RFDRl gc3oFL5/cCBLhfbP &downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.chuckledeliverynow.com/c?x=NdVmp4vZTBcfx6ajf0csqnCv6BkNRIC02PKZfAZcNRw=&c=euudZAB5Hl c7ESxlz6Xn5pJFcLyifiJTKi5Qre8EL02HpPFH1roj0s3Dr0FYWauFYr3a6Ue9VEkJAeugIkuG rhFFbTorsxl3pTMgdJ6Gls6yvSlPqXiEdVC8USqH7L&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

Remove java_update.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.