home

l377loading.exe

IE.exe

Free Software LLC

The application l377loading.exe by Free Software has been detected as adware by 11 anti-malware scanners. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from download.secure.edgesuite.net and multiple other hosts.
Publisher:
Free Software LLC  (signed and verified)

Product:
IE.exe

Version:
1.1.0.7

MD5:
baba823e3677676f39cfc9883e5b20c8

SHA-1:
ffc4a7a99c579fbd7b593aa9a2ea002d1aeee316

SHA-256:
a75b3fd12d465d0f5820a1c3ee93d8a59ed4a2c359aa58e42f4f4acecddb8be0

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Analysis date:
11/27/2024 8:46:52 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
APPL/Downloader.Gen8
7.11.171.32

avast!
Win32:Rootkit-gen [Rtk]
140813-1

AVG
Generic
2015.0.3358

Comodo Security
TrojWare.Win32.Agent.IEXT
19449

ESET NOD32
probably Win32/Vittalia.R potentially unwanted application
7.0.302.0

K7 AntiVirus
Adware
13.183.13286

Malwarebytes
PUP.Optional.Vittalia
v2014.09.07.10

Panda Antivirus
Trj/Genetic.gen
14.09.07.10

Reason Heuristics
PUP.FreeSoftware.L
14.9.6.13

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

File size:
692 KB (708,576 bytes)

Product version:
1.1.0.7

Copyright:
Copyright (C) 2014

Original file name:
IE.exe

File type:
Executable application (Win32 EXE)

Language:
Spanish (Spain, International Sort)

Common path:
C:\users\{user}\appdata\local\temp\l377loading.exe

Digital Signature
Signed by:
Free Software LLC

Authority:
Starfield Technologies, Inc.

Valid from:
8/1/2014 3:08:01 AM

Valid to:
7/22/2015 4:23:49 AM

Subject:
CN=Free Software LLC, O=Free Software LLC, L=Wilmington, S=Delaware, C=US

Issuer:
SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27DD6AADCC34E6

File PE Metadata
Compilation timestamp:
9/4/2014 4:32:37 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:/FpxgdusvDr1Mc4vnBKj/zKBOewKCdDo7700FcaibNT5fcp3/6K:tAdusvD2c4wOHyd0RKtdcp3/b

Entry address:
0x2C2CF

Entry point:
E8, D6, C2, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 88, 94, 47, 00, E8, 3B, 36, 00, 00, E8, A4, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, 69, C2, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 53, A4, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.1766

Code size:
408 KB (417,792 bytes)

The file l377loading.exe has been seen being distributed by the following 7 URLs.

http://download.secure.edgesuite.net/installers/axtan_installers/.../seo&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&r=381690&p=U0VP&loop=5&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&AL=37&EN=52&CD=6&NE=89&EA=87&DM=21&AJ=84&DH=7&FD=33&BA=95&t=1409991506&s=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.instseo.com/installers/axtan_installers/.../seo&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&r=2705687&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&loop=4&p=U0VP&KF=80&LD=73&HA=91&IF=59&CI=68&FJ=79&NH=28&BD=46&JN=2&CL=70&s=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.instseo.com/installers/axtan_installers/.../seo&p=U0VP&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&loop=3&r=3573780&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&DD=32&HA=34&KD=21&EI=75&EN=30&AG=62&CA=95&IE=66&AD=34&AA=22&s=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.instseo.com/installers/axtan_installers/.../seo&r=4264495&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&loop=2&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&p=U0VP&MK=64&EG=28&CL=78&DK=43&BA=38&IK=94&AK=58&LB=99&FL=36&DN=73&s=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.instseo.com/installers/axtan_installers/.../seo&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&loop=1&p=U0VP&r=842186&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&ML=41&DH=47&FJ=88&JD=100&FD=37&ND=70&GJ=54&HI=64&MF=27&HG=41&s=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://download.secure.edgesuite.net/installers/axtan_installers/.../seo&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAwOTA1MDA5MDYwMDkwNy9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwL3Nlby9zcGFuaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvY3BwLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L3ZpdDIvMC9pbnN0YWxsZXJfamRvd25sb2FkZXJfU3BhbmlzaC5leGU=&p=U0VP&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC9zZW8vc3BhbmlzaC9zZW8vY2hyb21lL2pkb3dubG9hZGVyL2NwcC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS92aXQyLzAvaW5zdGFsbGVyX2pkb3dubG9hZGVyX1NwYW5pc2guZXhl&loop=0&s=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

http://jdownloader.com/down2.php

Remove l377loading.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.