home

pobierz_winrar_32-bit_wersja_stabilna_v5.30.exe

Program

AgileMax (New Media Holdings Ltd.)

The application pobierz_winrar_32-bit_wersja_stabilna_v5.30.exe, “Program Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Program

Description:
Program Setup

Version:
4.4.1.5

MD5:
7753a429d0cb277cdbb9b51217f7a0c4

SHA-1:
d5300719fcf787d443fa34085b9edffbe1c166ac

SHA-256:
ddf0dc05d9827f363eb6f921801e22818750b550daa9982e1f259891719a6a28

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 6:28:15 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.17.20

File size:
990.7 KB (1,014,520 bytes)

Product version:
5.6

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\pobierz_winrar_32-bit_wersja_stabilna_v5.30.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:04:31 PM

Valid to:
10/30/2016 4:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:s5aaWPxdZx1o9RI7EJPwnAfBKIQiAK9rxdTGn6qIUjB9ySF+4riy3pPYXRQRgbDQ:s5arJx1o9i7EqWQijTuZjn+FQSHupF

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file pobierz_winrar_32-bit_wersja_stabilna_v5.30.exe has been seen being distributed by the following 7 URLs.

http://www.byteapplicationvaults.com/c?x=GdAGm/POGtbBAUxoHUpfdS/jQ5zRUzMowv7BcKmmhoI=&c=aqwaX 5AIjHHEri8Ys1VTMkmwiRbClJou lmPd/wJ1LD3CeKEZgssyuTyp62lKeNknNVRIWqAG459cKY/BS2hVAX6mamhl6GPzjcbQ GBvAhS7YwKyhwFbVBx0mOh0GB&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.signtourupdate.com/c?x=ykSw 3bLZyN01fTOEwOshxtOyU7H4llayFdNO VLfug=&c=9ybbce8 S7qY5LFTreUYd2my PP4tzH1RbFZI0ebis0N2g4ZKembacqQT9NZHvsB0eyQRCj Ml1Z6bxvdl89BZoLOBF31cGG8Rk4JxUasHDBqdbdATudMnzSRBq 1h/Ip1I8k1nQoZmBMccJpPiz6A==&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=C3dFmUQjRiT63wvZZ6 TKohvGMac Om8/tyZD6foRYk=&c=/WVBmnsKgTJABEuLFuLEHQEII bDaxaHTmvekuc02bIenQ/aS0KQa/rgojTdM7J/1MMfRwOwBOFc9ZqYE0Uj1y9OF6bpFptFY42lFQjr103NJIIA6K7ZAzwwB2rwXKeYelz71TR02HkxXLdQhnKldA==&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.quickmetaconecpt.com/c?x=4fSDS5GMvHCN8/gtCMdg9R/3obca0jahyumb8/88jRo=&c=fc1CPNFxr4Txm0BGRyY4ni/ZY0AMuag2wns2a9yPPFTMb6pUiPJUn1 Xloiqqf5E3SJd tvMaq0MentSdL1LztWKVpyaSqZGMoloOEEVQk989mP9YrDT6RvWunC6Tqx3&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=Vfm On8vmTpYC0CTJsLIjrKwa14JEMrQxW4NEWBt1eM=&c=AWcK3f8PZ2P5CzgzS66uwwbd5Cv rSUF TpKPh6Sz7fxn0M/FvOdiL0ZBAZF4SMIQRs v0mqB3ZPOI7HQ6vG1M3G28uFWdTVItbHNiw E7VWYnilaSICl6jo/lsrQsq4mySzQ3liLhL/TJ2E7ESRnw==&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=59GEAkGghYbEJgeczmgm0tTy2zQ89lCCvWK3HebUCqE=&c=w/UlNizZFoojqtinB1CbvnrD28MfQ1M6mQjc6MTEiaW8t4NkmrQMyQfZpemW7AlIFdEcKCm5ffL8 pe3ufeV 5Oy7yNsEq4tF1ARmDG3Rj3X0N sxgBcYaAPnqn3TOo &downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

http://www.byteapplicationvaults.com/c?x=ue98K su/JW1frZGS2XMpskdfYyGPVWq RwZ1Pu5lNQ=&c=C/wffQKG7cyMFDI0l8BnVAu KSHmNVAvtTZvjLCUi255DLq6mNWElz8m AeWonfk KnNpyDBl6bA07o46ThSzpaSJl0bZvv/diEDM qTTAW xaHdn5/8UnD1n2LY12rniJQC4QGFgE/cmf7P2sakDQ==&downloadAs=pobierz_Winrar_32-bit_wersja_stabilna_V5.30.exe&fallback_url=http://.../

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.