home

pivot_v4-1.exe

Generic App Web

Motus Software Ltd

The application pivot_v4-1.exe, “Generic App Web Setup ” by Motus Software has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.headupdatebundle.com and multiple other hosts.
Publisher:
Software   (signed by Motus Software Ltd)

Product:
Generic App Web

Description:
Generic App Web Setup

MD5:
fcd1e0e82c0acb315f434a56e83c38a8

SHA-1:
188fc5f13309ad1e7ea3b3178f2727100bb5460d

SHA-256:
11d091b893b2582b09059341d67952903904f7e93aeaf811a363b00129da2ad9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 1:45:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.2.9.0

File size:
952.4 KB (975,288 bytes)

Product version:
3.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\pivot_v4-1.exe

Digital Signature
Signed by:
Motus Software Ltd

Authority:
thawte, Inc.

Valid from:
1/8/2015 7:00:00 PM

Valid to:
1/9/2016 6:59:59 PM

Subject:
CN=Motus Software Ltd, OU=IT, O=Motus Software Ltd, L=Lewes, S=East Sussex, C=GB

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1B195E0268790297EB8AF4694873FE36

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QvuNl6ONtpgIGmfdi0GgGcpJxFNHyGiDdSOHiBkh3u4qx1NIbK5G5RF:QvuaWtpxhg0GYpJPfsHOkh3kx1ibyqRF

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9333

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file pivot_v4-1.exe has been seen being distributed by the following 12 URLs.

http://www.headupdatebundle.com/c?x=w5gIKOYQQ/uFzPQJbh7aHRtMYM9yD9FCSzdtu1mhRUw=&c=wIwq2jGkD7CzE7OQxL5aY1w7PVXDAEIZwyXVWycxaDrJc2Y/HIpMKukcQXOb9zjqpxh/mLCaNctNaH7MR CRhI4o83OOtezNw2zu6WARis 4y4o fsEoYgO4O6khoZF/LnkvZhKSlFmK1ngdn9FRsg==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=Dc2q20mLY6oUvtQp1fzUbPwFR8dWS597OUT8WDTZvZ4=&c=B9a72vQ4RQIqquDHa4VwBsIFdO9wmRXV0l7m3Ety89/eANcBP1mZy47tZZIwcCgsfiMTYnCr6ID6E0JFWno6A6bpQN9uodaQCNS1ypeM/c1xbX2WmEz4oKwP 7VwFL/fX6fEPIi5lwBPCwR0v2sSUA==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=ug04oh53CIiDlRM6T ZYhqShTiIfWFimFAejaZjSXcI=&c=FfWfCNTS4/U8KF09yWc/BrF4swdzybG5/E18fd4MPIkP85bLw0c3IXIMEmbsl XO2MWHbfBz9RVVpNE5/p1qe/mw5EbdA9r/Lz1KQMm05f ss 5Pk8ZMnkH3UAXlmNl8KVQqJftnOtzNqM HWJUG g==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=3dmmeh/ikjyLRAb8vaSA4f6nivCYsjb5ZzFJQT6p3Hs=&c=l5Wlke9PoaFvuFbqHBTirs8szKpkA1aBcUaUOhBZmacBWYC5BNwjlMWfhP/SpXiZypJ9n2MF74bLdBGEyF2yfiBBNUFGyBdpax7Rltct4uX dEqKcMCbqdv1SSLWFdcQ/N22c0w RjoAWSnUA6pl3Q==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe&re=1

http://www.headupdatebundle.com/c?x=vzWD bDehhXuwIw71dtQgZniwtsa 3vAXvnkFD6UP0E=&c=L1KdhYWPk8CLaSrxQ9WPTXMe6A2tXnxSe7SMN2e6aDpy2d0VVzfJLMOqKfihbyYb6mWL7oshjvrVihIz6ESdoIc55hyhQ4cQ7buZ7LY94/4e/I8UnsLXAzTbPO2FxTtT h1bowCQvt1weLRbhwDG g==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=qc4p507Vx5ZlCwTeLPsl7v32Gn/MsQXce4HeifMK2kA=&c=3fX6LpADHL M7Uw/G6CFMCo23iNz8L8d/OZS0OPfXJP/XQLUOeOqUQx4I4cbOe5d3SU6t19jHoUZ1zdA4B8ZotU5WqUYuxbRvyoDnM2pmKumXKkcEO62P4qVQGyoG/8GvMFHNBsQUv862VlPHmyMKA==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=XQ3uot/8V0TglPs6/Ulwu/JwnyXvNdCPPHOuk2b3K30=&c=E3lJwimZTvastx0uq3 RdfLIYUJAAhktjGJ41eINJru9MXLgcgdVIoqYExxsugmA/GSUwrNMYR0z7esco/x/NK6MyYpYSUdW0nUpNVMtQ/toMkaVmEnepNJgNfjaFXusqxpOG/2Wcs4fkJk2Sy9Ziw==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=yKiDZWHDLCCS8Ndy6ebh08mT0BPR4oODviTqcmuFmrs=&c= 4qs6TKwh 4hjCRdsKFgRSZPe51sjB 5rWd67tKyDqNokNaVtgCj M3ieADJUfor1RTn3NQheRgu2IyXV9b/cH13fFxAPH9A7Z8jQyOx6K3pS/hTLOZrF3rwWp1moDo9cY KosIbLz1QqIzzWjrSvg==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=8qS8jL35mFn8Gi/TVU7JqIWmfP0q P3wwKzUsLUgXQ=&c=Yra77aNb8KeRp4uKmS7FCJ0jt8H93UNTwDXHEY6ev1z/ohhC6A1sFMrFsF38e2ETYrip1RNQDegymYT0OVo1kyU6QnGiXZGt7YbZGjac6RsqJyf/FXeOA76KAFaOmJDnSHe2q5g6k8nAZZRa17ZxEA==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=YGpEJOFYgLnrnAIXr6gkmoVmYJWptVHuW0xTS0GmCLw=&c=qH08G8IN6mOp/pOvv cpsv4QcaIsy9HXUmJRbUed7o7cqyC3B2Mc2u4zY35JgRVAYIzakNNapYd4tekszYDwCSL9fW6/NEoVlvkDZ57QazrXVHJ1qXaQtPOTOTaJ4maT4UUHcb5Gnp9Iwy8vx48mXg==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=DEkQwnq9gQTFsCaev9HPmQQ4QY1uCbnTnbZpDMD7TAY=&c=cgvjvoH5r2nK1af35F/Ky1YQgaB7eFiDrclUiU13aK07D EO4Z29/4g4L9lehFUYPVEa27GexLQ7P1Cq2FlkNJRyhFcNox6m4m6qq0UrubUYh7jktFxbproU4xGwTcKlPD3gD6XNgvEN7criKmW1w==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

http://www.headupdatebundle.com/c?x=ALuGRueJBj j5zNoKrL/zcb w12INOCos7fyFq7UVLQ=&c=BYrTZMtP6R6U7w0v1v8SXroFZRk53OEOBfgWbscMD9xO266B1n CafBD0DrB0 hHpcU1yqywLRxyN0iHu3IPZndIQXiJcEIXlLkzyXZ5RwYGr4zcHF8Z8lcrZg2k3XTzFANmqed66XSx0fyxHhIETw==&downloadAs=pivot_v4-1.exe&fallback_url=http://.../test.exe

Remove pivot_v4-1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.