» microsoft security essentials.exe
Overview
Analysis
File Details
Downloads (3)

microsoft security essentials.exe

StART Playing

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application microsoft security essentials.exe by StART Playing has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from get.down0101tech.info and multiple other hosts.

File name:

Publisher:

StART Playing (signed and verified)

MD5:

ea8256cbccc04bbaa41cc97f6f4e9574

SHA-1:

2735abfbe89e9afbfe5487e598a015390c988902

SHA-256:

2ec9c3f2233574ea55612f428feaefac338020af2a0b4236cce32bb730e3b269

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/26/2024 10:52:43 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.Outbrowse.1

6514867

Agnitum Outpost

PUA.OutBrowse

7.1.1

AhnLab V3 Security

PUP/Win32.OutBrowse

2015.03.17

Avira AntiVirus

PUA/Outbrowse.Gen

7.11.217.176

avast!

Adware-gen [Adw]

2014.9-150316

AVG

Potentially harmful program Downloader

2016.0.3168

Bitdefender

Gen:Variant.Application.Bundler.Outbrowse.1

1.0.20.375

Comodo Security

Application.Win32.AltBrowse.HY

21434

Dr.Web

Trojan.OutBrowse.58

9.0.1.075

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.Outbrowse

9.0.0.4799

ESET NOD32

Win32/OutBrowse.BS potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

Riskware/OutBrowse

3/16/2015

F-Secure

Gen:Variant.Application.Bundler

11.2015-16-03_2

G Data

Gen:Variant.Application.Bundler.Outbrowse

15.3.25

herdProtect (fuzzy)

variant of adobe photoshop cs6.exe (Adware)

2015.6.22.8

K7 AntiVirus

Trojan

13.193.14803

Kaspersky

not-a-virus:Downloader.NSIS.OutBrowse

14.0.0.2337

Malwarebytes

PUP.Optional.OutBrowse

v2015.03.16.12

McAfee

Program.Adware-OutBrowse.e

5600.6824

MicroWorld eScan

Gen:Variant.Application.Bundler.Outbrowse.1

16.0.0.225

NANO AntiVirus

Trojan.Win32.OutBrowse.dnberl

0.30.0.65070

Reason Heuristics

PUP.Bundler.Outbrowse

15.3.16.12

Trend Micro House Call

Suspici.F4CBE3E4

7.2.75

Vba32 AntiVirus

Downloader.OutBrowse

3.12.26.3

VIPRE Antivirus

Threat.4823950

36694

File size:

573.8 KB (587,584 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OutBrowse Revenyou (using Nullsoft Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\microsoft security essentials.exe

Digital Signature

Signed by:

StART Playing

Authority:

thawte, Inc.

Valid from:

1/18/2015 7:00:00 PM

Valid to:

12/11/2015 6:59:59 PM

Subject:

CN=StART Playing, O=StART Playing, L=Dublin, S=Dublin, C=IE

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

58DF35F2B2CFE8E44EF980DD11E01B9F

File PE Metadata

Compilation timestamp:

12/5/2009 5:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:R5I5HSxHOOMuKIX0p6poP1vtN7DPFbwjIY7OnQrBHA:RMyUOMCCKoP1rXmjHGQru

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9707

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file microsoft security essentials.exe has been seen being distributed by the following 3 URLs.

http://get.down0101tech.info/1421765800/get16?p=414&d=24027&l=9338&n=1&productname=free-downloadss.com&d1=1&d2=1&d3=1&d4=1&d5=40084&exeurl=http://mse.dlservice.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/.../mseinstall.exe&dynamicname=Microsoft Security Essentials&filename=Microsoft Security Essentials

http://get.file20desktop.com/DownloadManager/Get2?p=414&d=24027&l=9338&n=1&productname=free-downloadss.com&d1=1&d2=1&d3=1&d4=1&d5=40084&exeurl=http://mse.dlservice.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/.../mseinstall.exe&dynamicname=Microsoft Security Essentials&filename=Microsoft Security Essentials

http://www.ifreeupdates.com/.../download.php?id=54be6a87f0a5b&i=40084

Remove microsoft security essentials.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.