» microsoft-office-professional-2007.exe
Overview
Analysis
File Details
Downloads (1)

microsoft-office-professional-2007.exe

Mala

Bibado Investments S.L.

The application microsoft-office-professional-2007.exe, “Mala Setup ” by Bibado Investments S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaultsfarmhosting.com.

File name:

Publisher:

Bibado Investments S.L. (signed and verified)

Product:

Mala

Description:

Mala Setup

Version:

1.6.2.4

MD5:

6ff9549a6f7fc84c57961c720cb509b6

SHA-1:

99a5a53c51c274c949fc78bb92c7537e8fddaa82

SHA-256:

7e2a9894f99dbad6f09f64bd919fb2078f44bd8f5210ec7551d1aab959162fc4

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/27/2024 3:20:04 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

17.1.11.2

File size:

1.2 MB (1,253,064 bytes)

Product version:

4.6

Stub fast

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Bibado Downloader (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\microsoft-office-professional-2007.exe

Digital Signature

Signed by:

Bibado Investments S.L.

Authority:

GlobalSign nv-sa

Valid from:

12/17/2015 7:45:47 PM

Valid to:

10/10/2016 7:59:18 PM

Subject:

CN=Bibado Investments S.L., O=Bibado Investments S.L., L=Alcorcon, C=ES

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C7CDCA8256DFB1BF27E11C9CC97F08E3

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.8922

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file microsoft-office-professional-2007.exe has been seen being distributed by the following URL.

http://www.vaultsfarmhosting.com/o _Wb62t1Rbj2Wdng2vt1LkFuYZMmF7Up7Lb7WbPMvJgZnw94q6e _EeVI4aM_lJbdScRXjKRkiLgqWAWZ0afJCZ1KH2cGfW66tavSPpGCvS7A aqBcEGuXezCaSf7BVJm27qYjWGijxqjeTXI0s lkkMEPa1xYxViYOYrhL0pP8zo0D78TySEfyGiKP7q7iHLSTh_bfc4lQa5WF_Tb1to8GLMGFgw==-G0EDAGTCTWwcqCDaVyC4hIUTcZjIAXtbDDGfxN4bB56sMfKzCMwtPca8L87k6He8Z_vYKWxB2pKucNo1FVExD8q IofUvQH43mLCYn91kEEV1wSbozRHKj9WsRqkpLi802BIyY6Bg5gPzaEWTzeWcsE3nxgVRlTcOEe26y8wPGWLanPXMsp4btedYHiH9rdbzbgubHUbKJpmXreOhUWLkFB fyu6 gYqBbZBMNGGR IOxTJ CTP6lK38I1d6ylJzjKcV2KcsmF2C7GZJDum0rVbkssyQywFzzXCE1QQOGWZnjKLRHS4WggG0sDYJ8dQVj4FEjhOWk8fql2wtViLjoXsr9DJhN8Z5t75pLfk09HyVOlERF5ggh3cgOYwv44JbwchgWSaWdZpRUIYvEf96MotO 5E4HFnH7rtihOR2VD 8DiNgllF5ySd4e2UnUq41S_A1QodvuFZotWuIt04GGgRvQ7SMlAsQtkKdW99N7o ve7xHsaDBxyy mBmA1ql z4CG8m lMt47vG0t L7i2RkfM9QGOCW0gaNLnKcP3Nqu2aIPUZvNCFPMgf4wtONKdynrLi8I2IrZYEKijgqMD kKKk8vVVtsFVIjLOf8GaBhjLz5fUD4i1JoNkEUQFkS1q7agqBCybG2TYNBSqqszZuDB5WqL5N6rYFaFiEtOVNH23XsCkOlHIfB1Ph7CqbCY3FdkVnBmG4lwwLxfNlha2D0Jl0JNyDdl_7nn5

Remove microsoft-office-professional-2007.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.