» pdflite-200.exe
Overview
Analysis
File Details
Downloads (9)

pdflite-200.exe

Kemulaf

Beta Setup (Alpha Criteria Ltd.)

The application pdflite-200.exe, “Kemulaf Setup ” by Beta Setup (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.packagerepositorypackage.com and multiple other hosts.

File name:

pdflite-200.exe

Publisher:

Beta Setup (Alpha Criteria Ltd.) (signed and verified)

Product:

Kemulaf

Description:

Kemulaf Setup

Version:

4.0.5.5

MD5:

8aac539dde61e5833d6a69e13602db5f

SHA-1:

92f47301673a5be503e9116651c5da5bee7c8fe9

SHA-256:

86a494363038b5bd21b1c7d22c7a322d4acda4e2bbc366e059f4f01516f0cee0

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/27/2024 7:48:27 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AC.Installer (M)

16.7.7.16

File size:

947.1 KB (969,864 bytes)

Product version:

4.0.4

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\pdflite-200.exe

Digital Signature

Signed by:

Beta Setup (Alpha Criteria Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

12/31/2015 5:05:12 AM

Valid to:

7/27/2016 11:04:14 AM

Subject:

CN=Beta Setup (Alpha Criteria Ltd.), O=Beta Setup (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121DBA9CC399DC1BEE2669DA6FF3ACD5A4E

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:AmiYVeWr1yz9xU1DVoYer+Fk6xcJ4MkdvuICc:A3CUhx8mYC+FnxbdvuIn

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9324

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file pdflite-200.exe has been seen being distributed by the following 9 URLs.

http://www.packagerepositorypackage.com/c?x=A3ZXAZxG3cGiKn1Ae/z4gAtXOmZKDswCpd243cIMH28=&c=DP2OySafo8lCF07gZQJ1es4Szfrc0RjF 9kR1ADCjtIhWyhM7m2Ts8j5Mxe1H18V294IDXY0gNsQdV/6BB0GvmZzJSJBVwTuTxAUHhh0fXS7YJK1yHFwpk8lMNw2QOtA&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=4k rWaqItfBHwTv4MMdeLJ4gEjgNMnhKPlBDu8tN Qs=&c=yk0B3ZnxoSSJ6uBLVB8AsxdmzMw1gJ9VyjkGVF fZlpdRH37Wk0EwHIdT1EyOEvDpkotxJbyMcWiGOeLChV3cJhMNcjOoZ7YlkX7hAQfygdJuo Fmt51aKBDlrMjAeYM&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=FGjXYoeI7wnnK72I7YIrEQ6DHrwnCdR70xNqm32alR0=&c=dRHKpY0cCUiAI6woeEqeBxmw0xvyxKzgU67kMPisd9E7lF1axVHD0QWqXaCxKux3YZFCmmseYYOmuIqeDM31oZPnjHXnWFiA822NjBgG5dCwD45huXi/BESep1hMlMtn&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=7Ksr5kyXhMRULwZGD2jCaErKsoHzQgcSomri7GIWsbA=&c=dP7f5dBmuNAJ7o12wFMqROWJM6mprXbimK45 BQD8kRT8VvHc6mkxtJY8BETc7DN8vm1rw/jqLLjvJC4YsHtPUO1UDB7aQ8/WDWsbf51XN7ktL1tCCdQrzrXSNUlUXEN&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=2OHdLS71bSUPMyKl gCno0H2cAvwFm5iNZXyB84tEec=&c=NRPE6fflhvUZhLv4IV7cmHczXgXwYHaGa7Hrcz6/ HRM7fLpjj18fr8fp/ArQzRSwR7tiWUM/WtcssznMb9rV5QtPmkdx1roS/sqLQcEOHSgDWLQW9VqFFbMW9rYudR4&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=OoDMQmOLfJe3A2d1PuPg3FfPDTG8P9qQIhEWyV0pWVg=&c=OQ/ZEn MZuNYTXwB2cVwLFKy2sS8s8K0p 0IilqGvMFgo1DhMxo2r3xj5zOrEsxgDALd9IGrdgNaU9y972R3qUHlCgQfcMy9ZTSFm1XaCH7ylCQABu7tIcxFNp0n3kCW&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=KlN0lLNXq2vqeI8e3UqZ/tTzuJ9xQ90Gtzo01R9TOsY=&c=8qwBQWAhscF7KGR44g8FRKItLWCBZx1JSVWtwYCCgzV1VZy5h2Px0YqjCnbGd0j142E6pcagzIoPrNBgr7xCcGxFm0S16vRONAW5ultfWOHniky3 eNknk/zrtgKGTRv&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=rGLpFGiti33kteauXv9lpJ14aDg083puXT3h3l7fFRA=&c=nBUnV936GqQS7 y7PN5FHhWLXAQeMwSY6jg9XsB9nYIr/7bKlRejheT/59utpARmDfBv1VS9NAbOkFmQar0SPAQnGUfG1BGOD567EtZqFlVUNaXNOetoDD9G52HVaRKw&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

http://www.packagerepositorypackage.com/c?x=gvnlxfOxv4wvdK0lri2q6We Gfq 5h JXWood6VrKSk=&c=/wnPLRRkLdDtLzSW7LPW/P4NUpjekuQZVCGiQmat6DLz6btyhbNsm1zICilfED8XyD1EKU4buhZfcmKFF2pHwwyLwH7NyWWKMaAaqwajlYosW0XdihO 7DcqmXKCImOZ&downloadAs=PDFlite-200.exe&fallback_url=http://.../setup-pdflite-2.0.0.0-silent.exe

Remove pdflite-200.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.