» mirovideoconverter_openinstall.exe
Overview
Analysis
File Details
Downloads (1)

mirovideoconverter_openinstall.exe

My Program

Participatory Culture Foundation

The application mirovideoconverter_openinstall.exe, “My Program Setup ” by Participatory Culture Foundation has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from icdn.mirovideoconverterfiles.com.

File name:

Publisher:

Participatory Culture Foundation (signed and verified)

Product:

My Program

Description:

My Program Setup

MD5:

cbf8a727fbb1032b0efde4acb444790d

SHA-1:

e1e2ce4fa1a5edc299638d26851c074fef0717e5

SHA-256:

c0a3c17281265dd39517932557b7d83af2110002a5b719bed1144ad47380012a

Scanner detections:

6 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

12/26/2024 4:29:23 AM UTC (today)

Scan engine

Detection

Engine version

AVG

InstallCore

2015.0.3374

ESET NOD32

Win32/InstallCore.PX (variant)

8.10297

McAfee

Artemis!CBF8A727FBB1

5600.7030

Reason Heuristics

PUP.Installer.ParticipatoryCultureFoundation.EE

14.8.22.16

SUPERAntiSpyware

PUP.InstallCore/Variant

10406

Trend Micro House Call

Suspicious_GEN.F47V0811

7.2.234

File size:

801.7 KB (820,928 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\mirovideoconverter_openinstall.exe

Digital Signature

Signed by:

Participatory Culture Foundation

Authority:

Starfield Technologies, Inc.

Valid from:

12/10/2012 12:53:33 PM

Valid to:

11/12/2014 6:11:52 PM

Subject:

CN=Participatory Culture Foundation, O=Participatory Culture Foundation, L=Boston, S=MA, C=US

Issuer:

CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4B7A89C3505610

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:YFvRCFLOTj4ake/7JsRd035ltpB6scktUE+GyyLLYs/p17TsjYqe9fMJ2hBh:YZRCwD/7uu5yscqUEnxLLRzTsTeygH

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8232

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file mirovideoconverter_openinstall.exe has been seen being distributed by the following URL.

http://icdn.mirovideoconverterfiles.com/MiroVideoConverter_openinstall.exe

Remove mirovideoconverter_openinstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.