» microsoft office 2010.exe
Overview
Analysis
File Details
Network (2)

microsoft office 2010.exe

installation process

SETUPPROCESS

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application microsoft office 2010.exe, “Installer Manager” by SETUPPROCESS has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.

File name:

Publisher:

SetupProcess SL (signed by SETUPPROCESS)

Product:

installation process

Description:

Installer Manager

Version:

1.0.1.40

MD5:

bcf57d614bb494689c7b54b5cc8a0870

SHA-1:

a9645f0986a88050891628d8483877564544491d

SHA-256:

b49026e3ce2d28ba6fbbf0f5b7cd697308fd54f96d216d72242bf172ac9c0ff0

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/24/2024 11:45:01 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Solimba (M)

17.3.14.21

File size:

248.9 KB (254,832 bytes)

Product version:

3.0.28

Original file name:

installer

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\Musicas fabricio\microsoft office 2010.exe

Digital Signature

Signed by:

SETUPPROCESS

Authority:

DigiCert Inc

Valid from:

11/26/2013 10:00:00 PM

Valid to:

12/1/2014 10:00:00 AM

Subject:

CN=SETUPPROCESS, O=SETUPPROCESS, L=Badalona, S=Barcelona, C=ES

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0A8ABFC7C80D0C2F0A3A89CF6139A91D

File PE Metadata

Compilation timestamp:

1/27/2014 2:02:51 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

Entry address:

0x6F3B0

Entry point:

60, BE, 00, C0, 43, 00, 8D, BE, 00, 50, FC, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

208 KB (212,992 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/1897934793/launch

Remove microsoft office 2010.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.