home

microsoft visual studio express.exe

fulgeo regius imputo mendosus XLVI-II

Condestil Developments s.l.

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application microsoft visual studio express.exe by Condestil Developments s.l has been detected as adware by 28 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from sanefile.com.
Publisher:
procella subvenio  (signed by Condestil Developments s.l.)

Product:
fulgeo regius imputo mendosus XLVI-II

Description:
oportunitas

Version:
2.91.50.16

MD5:
efea9458e16b5a8a4055a1ed20aa2dd4

SHA-1:
3bef3189a34592ef3cae26416ffa96d54e72dc9d

SHA-256:
778cfd7b1d53f8aa1f746256d7883643051382c407c8b0b9c17c2e31e8f84e57

Scanner detections:
28 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/24/2024 11:46:11 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Generic.1022271
655

Agnitum Outpost
PUA.Solimba
7.1.1

AhnLab V3 Security
PUP/Win32.Solimba
2014.10.31

Avira AntiVirus
APPL/Firseria.Gen8
7.11.182.126

AVG
Win.Threat.Medium
2016.0.3133

Bitdefender
Application.Generic.1022271
1.0.20.550

Comodo Security
Application.Win32.Solimba.LSW
19950

Dr.Web
Adware.Downware.8808
9.0.1.0110

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Kazy.132995
8.15.04.20.06

ESET NOD32
MSIL/Solimba.AH potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/Morstars
4/20/2015

F-Prot
W32/A-a1e0d357
v6.4.7.1.166

F-Secure
Riskware.Application.Generic.1022271
11.2015-20-04_2

G Data
Win32.Application.Morstar
15.4.24

herdProtect (fuzzy)
variant of showbox installer.exe (Adware)
2015.7.22.4

IKARUS anti.virus
AdWare.BundleApp
t3scan.1.8.5.0

K7 AntiVirus
Unwanted-Program
13.185.13853

Malwarebytes
PUP.Optional.Solimba
v2015.04.20.06

McAfee
Trojan.GenericATG-FARG!B5176819D010
5600.6789

MicroWorld eScan
Gen:Variant.Application.Bundler.Kazy.132995
16.0.0.330

NANO AntiVirus
Riskware.Win32.Downware.dhbsmu
0.28.6.62995

Panda Antivirus
Trj/Genetic.gen
15.04.20.06

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Quick Heal
Adware.Firseria.A5
4.15.14.00

Reason Heuristics
Threat.CondestilDevelopments
15.4.20.14

Sophos
PUA 'Solimba Installer'
5.10

Vba32 AntiVirus
Downware.Morstar
3.12.26.3

VIPRE Antivirus
Threat.4782980
34232

File size:
537.7 KB (550,624 bytes)

Product version:
44.53.46.19

Copyright:
Copyright 2014 exhibeo victor

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Common path:
C:\users\{user}\downloads\microsoft visual studio express.exe

Digital Signature
Signed by:
Condestil Developments s.l.

Authority:
Thawte, Inc.

Valid from:
7/24/2014 7:00:00 PM

Valid to:
7/24/2016 6:59:59 PM

Subject:
CN=Condestil Developments s.l., O=Condestil Developments s.l., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
43F850AA43DAD92FF6603BEB72F415DD

File PE Metadata
Compilation timestamp:
10/23/2014 8:29:26 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:ft7UtRmuUFGTEnMLe2XcWrHGN9xVT8dvE4A8dqdYNiaZy9AN9QBTwD:ft+aGTc4cWrqYEyCGU9ANWwD

Entry address:
0xDE2C

Entry point:
E8, A3, 6C, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, F8, 6F, 42, 00, E8, FE, 15, 00, 00, E8, 74, 6E, 00, 00, 0F, B7, F0, 6A, 02, E8, 36, 6C, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, FF, 64, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.7038  (probably packed)

Code size:
113.5 KB (116,224 bytes)

The file microsoft visual studio express.exe has been seen being distributed by the following URL.

http://sanefile.com/n/3.1.46/.../Microsoft Visual Studio Express.exe

Remove microsoft visual studio express.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.