home

sin confirmar 685572.crdownload

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The file sin confirmar 685572.crdownload, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.sendtowersnew.com and multiple other hosts.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
a01866856694afec3dd572a6634e5ed4

SHA-1:
62e262986093b8d293175ef2ea05a83933ee300c

SHA-256:
fc188d0758006ed071c1ba12ce0c1ca4a5ae2c4ceef6cfb7d132fdaf1c83fc9b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 7:50:11 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.22.16

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\sin confirmar 685572.crdownload

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 9:04:31 AM

Valid to:
10/30/2016 12:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:vKSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:vreTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file sin confirmar 685572.crdownload has been seen being distributed by the following 6 URLs.

http://www.sendtowersnew.com/c?x=7ObVcrZn7m3Vzs8cMnumruENz1r8Od2vDxq/PfWrsYk=&c=QUP8TWQdt IPFyhKPYk7CoYf9H0BhQcDuAWSOy0aCLK7DHrSaTdOixaLuH6FdJZy/geYGwAEHahsSPI4aw56kOEBhgm0GrbSOldeNRUo9w6nC3oTEiwfBV2cd0w/7QhCT9y0f6qMThUjKIoEWGcTajA59BOwYXWIaBnqnrfLtVg=&e=0&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

http://www.sendtowersnew.com/c?x=gFCbumYAQxjTdobea00lywFn0iGwOPts9GHznZFSRn8=&c=og wqZTaq At9S7oxd8kY/BabZ6GkwwRCaqeQGbZI34FHDuS88tPfxppqPKCSrampkxBIOKcaAHRiJKBUclL57l7K75DbyuHKoJgLUrCRYzZtFqD7Div6kQJnDCeSnx5MO0JBRwCjqxVd8bq7fRndPTDZt1x7C 31IqFzl0gyEk=&e=0&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

http://www.bundlecentralbulk.com/c?x=vRrfCNK741dvU2Es1xWKlxWLR9/wpiCR1WH41ngeCnU=&c=i/3DvrGcssqcG2hp0ApwFH4BHa3tud/FkAs2aI2WSfuYp0EFjWhUqAXoW6rHHR2GjDK7wIoQitXl7WWlEsPTOeqnMK4psPt9L7z9bvFjgDY/IbjLRODT0EV1sgCw1dbhfFudz8rdl03RO0Un128CWiXyj1mdA2r2BHDTj sn1vo=&e=0&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

http://www.sendtowersnew.com/c?x=N5dst1qmwvBWQluH2sb5OYLZzSp8HiIVb7ugtMgBgNU=&c=A0/gw6TpWuHnkKN3l8u7hvS4ArZINTSgo/sRygvT3PeAHVuL9nhVBgKmE2/Hsv93I7vN5JMNgqpdYLZF GO7ETtf4cMeqkys1d2ARsclX6SdzX0AxVcWsZ1nP3lhu7JGum6Q4Xx69nsXP0hLDZX Ip/9whdG5sMLGbg05xtuLG1/1DPEE4MpJqaw xJC2q8X&e=0&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

http://www.headsignchuckle.com/c?x=erlLDmRSTZtFjaUqFgn7hN92NIn1ZTLi73VBu/aTHPk=&c=w5y6kuQkELcSRCRfFDRlv8NvgUoijYG7PJbb aYrRS6G0q LlFfFy6NLY83fShM0fOqHApNDNm9d2R2cUitUvnIB7sNJPw5RFLtSpN5r17XpWZCgURHom8zUnrMkLwytljeGHfEnewwDBLep7PKpW0sgQ YblCW0wBB8MhNyWAM=&e=0&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

http://www.megavaultconecpt.com/c?x=0BujppmWUDBXKIg5LqyPEsSJynvKCOV2 LDhiZhIt5w=&c=zqbpMveg2yOcOVVil4rabykuugNJvdhXMHvUmamO9umF65wKWqPZvPM0U8F4bOfh/7OsEs971taS0hZnLlOPEDTl3slD1qvDxiezMS4gV/EdWQdOt2N0bYwwy5NcnI1htVdWLx6RPYSlloxTWn23hA==&downloadAs=corel-draw-programas-gratis-net.exe&fallback_url=http://.../CorelDrawGraphicsSuite_X7.exe

Remove sin confirmar 685572.crdownload - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.