home

spin-tires-1-3-beta-32-bits.exe

Web Installer

The application spin-tires-1-3-beta-32-bits.exe, “Web Installer Setup ” has been detected as a potentially unwanted program by 14 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from d.likelyaa.com and multiple other hosts.
Product:
Web Installer

Description:
Web Installer Setup

MD5:
fe42b1a0d3d7304434f507f012cef231

SHA-1:
af7057a158554057b41fad1512af04d94873dd59

SHA-256:
1e5d552068199d8e23a273ce439e507760bd58435281b86fa143ad3355e61f7a

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/27/2024 3:52:05 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
Adware/InstallCore.688617
7.11.204.248

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.151121

Comodo Security
Application.Win32.InstallCore.DAI
20837

ESET NOD32
Win32/InstallCore.QL (variant)
9.11069

Fortinet FortiGate
Riskware/InstallCore
11/21/2015

K7 AntiVirus
Trojan
13.192.14746

McAfee
Artemis!FE42B1A0D3D7
5600.6574

NANO AntiVirus
Riskware.Win32.InstallCore.dmhfwe
0.30.0.64812

Qihoo 360 Security
Win32/Virus.Adware.33d
1.0.0.1015

Reason Heuristics
PUP.InstallCore.Bundler (M)
15.11.21.16

Sophos
Generic PUA KP
4.98

Trend Micro House Call
Suspicious_GEN.F47V0108
7.2.325

VIPRE Antivirus
Trojan.Win32.Generic
36960

File size:
672.5 KB (688,617 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\spin-tires-1-3-beta-32-bits.exe

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:xMEFaWVBs7un8g7iGYYz/BgsC7HtJUzRfZR4QtFxT6nF8lrY2Hj38J1V:xBF70in8I/z/B/CztJUzRAQj0nFirRMt

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8901

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file spin-tires-1-3-beta-32-bits.exe has been seen being distributed by the following 2 URLs.

http://d.likelyaa.com/?ic_user_id=9289&data=z aZveq0eYiOhtaahKHHJYamXidQIzpXGGLHuewciA4G0sUZHpQKmIUDV4Hk8dXutQS5akaMesWj//BK0NGYNa2KHbsLbcXQ/HkAXdgMlh9W03ze489kyOFULvLwhf9sY6J2hf wzemRDNsFULG3EnuI30XWw7IapCKQRFahfeBgUMxddtM 5RH8Tcsgu5sf8OzuIBC20JdmxxjLqopyBi39BU6BPJfqJT/AJpXC3sc 5mIStdHcRx7JgiQor xC5h Z9olx1G7YsJehifEsLoJ96xvvmkcgpiqOGCIX0oX4Zn/WrhqY6q/txTCwsmIo8c25UAFrLJ5/WIi5 IX2gnnmP0ZvvEIbICFl0307I8AvuhHbQe1lNrK/OpXd2FbFmBnx14tvXt/6BK60zjScouPW5eAaiAtPOplGrO5O5sm0qu17HUks7oMSXQ5GwYb z8xXx107tn3wxl8o39L6QTNiTq5snBuKkLie6NAPd4PI7vcOlvRY5iKdqar8snbZ1tXRbCu1yIT62AMR2iTmvgdb5bxvGeQNthl2PN00vs0qnkJFYyR8vb Z1YCTbN8IHdp7BBZc89dQ0OKF9uYMAPSDPPd1a1I5EcrGgTv/isEq0wVN1ezXvLFROHs2iDXdUAa 9Tt9xg/i7Zzv8zVfXoNDtjHrEwn/U612pmOHvsrw2GXNpX2o5AggbaP74vMWkgIEfnD2vStCl mQX/KuxDsR32LpxVbVCEA2cYdmqR7TicnQGXT/w1M37GkuoUrWlY6Dhbe4L2bFz74=&key=DmT/Vay5IcnHt0TNlAZ6oupikVBQNBECOBbSKPysX4rfRCQgPc3nfVM1xOIDjdoDTTBFQIIaBH/.../kJlakjLR1u7wiuOeXFIjyxxEnxj

http://d.baixakifiles42.com/?ic_user_id=9289&data=M5zMuw9RHrcEVsxlmZbJOxAlxNaUXdnEfK897F4u/LJ7AWU8yeAtrEMT7kpsm J9fVsyL/pux jEzTau1k3sxOY5HzioVtpwmSkFgSoVE VrpNracnFfVz2bnkFpliyIyx2xI1B9wtP9wm0YoZlVEMbjqTbkwyv CrbZuAQxyH9ITucy4o9ynA6IZcUgIxS5P2krDGBPHZixuqpFt9 DAFmAIkdIDqP3PW2DYJhCTppxkM f5GxRbSb9sZKAFmSdCAB4CoT8Yr92TH0pLVvZz8lQMTnMo8FKd5XokbiJqSnKVARWuH/x7gwwxzkhN0WFBhAaYBtDuwDEopsyCrpqDl6fnCbEMBT5LzbnWLS2 CwH29kGUodkZHnEHS10Xq2r0GAXqUmK/9/uU/QtJMQvS0dkVzBqrZbTeOaVLup2R21uWbiwZDU98XjY20FFu21KZWagtZlurSClC0KP8CRtTIgWr/Meic3qjD/gg43PpD2PmQLhm95VVWwfzl2C6BJBSGZvS2SeISX2hv46W4n3hmqL s FHSQ9l5aETUsYToprNhmdfH7dB2CtwtaJ2kKhnfJEGWAvN8XSVcKrslayUoVQtvcIXRfM9lIhcXzb8NOeLBTClIkXfxQHEVcNQB9hqONoqessMuhKJsrObL91MZBwAOJ8ZjISDRwhBU8oV8pPFxeiL5ASiFJTzt5obpfrfkDRmLVA7ygLDP0QEbiLUOpArSTwMJWynVMHeukuvxTcAptcyCIcY7kWqudNJXG2w675BOTc0CclRgY=&key=bvwUqgOJOKatIYWCMDfFf0tCPjH/29PzXe2zeAjgDcDKJKu7AO 5I4KcC/FXf1C/.../m11HnLaeIioqKcm2fUMgJlvd4cYwObOJywOMgKFYLG EfjofQdwhyF8DJwvO7Ix66Gl4u 5IdrPTThaJJryCSVrKdIji1RI

Remove spin-tires-1-3-beta-32-bits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.