home

updatechecker.exe

QUICK IDEAS, S.L.

The application updatechecker.exe by QUICK IDEAS, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Nullsoft Install System installer. The file has been seen being downloaded from www.giftvaultnow.com and multiple other hosts.
Publisher:
QUICK IDEAS, S.L.  (signed and verified)

MD5:
f832d30c91a962c8c6fb210dcb8eaffd

SHA-1:
0196f9dd9e0735d03879796e05ee51139d442b3d

SHA-256:
bc6bbfc5addc28c2c9b1956e07d576244d0587ac2249c0e94a14dc3834e9de43

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Analysis date:
11/1/2024 4:32:41 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Vittalia.QUICKIDEAS.Installer (M)
16.1.27.2

File size:
81.4 KB (83,352 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\updatechecker.exe

Digital Signature
Signed by:
QUICK IDEAS, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
11/19/2013 5:50:57 PM

Valid to:
11/19/2014 5:50:57 PM

Subject:
CN="QUICK IDEAS, S.L.", O="QUICK IDEAS, S.L.", L=Madrid, S=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
27D76F50DDF2FF

File PE Metadata
Compilation timestamp:
1/5/2012 7:21:36 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
1536:tl1u4wYQzaWUqRNIk6MbklLsv1Q79wotCJJ4Romu/FkleeKu:tlU4wBzaWRRu38YLsdQGlJJ451lehu

Entry address:
0x4131

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 43, 43, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 44, 43, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 44, 43, 00, 56, A3, F4, 27, 43, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8B, 3B, 00, 00, A3, 50, 28, 43, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, A9, B2, 40, 00, FF, 15, AC, 44, 43, 00, 83, EC, 14, C7, 44, 24, 04, AA, B2, 40, 00, C7...
 
[+]

Code size:
33.5 KB (34,304 bytes)

The file updatechecker.exe has been seen being distributed by the following 7 URLs.

http://www.giftvaultnow.com/pgjgCA5xflZf5x35J8GHmAZCiatuLDVdcMUh6Y6u7z7qOGqg3CVazMFuICoMizIUg9 As4iLRToj4aMzwtlkHn9VPBmvbgxRSlEzkG77Uf2LkzG38KiEaIbE4thbVVbcL6vys BrR45z23Y5XsI4svMEaxjmnPU4ZgOsy2w5DYTgvRVd os=-Gz0AAES3eX7q03XGXzEoqBJNECZy4NBCCUAP9s42DuSNp8Hpvr78I33wPTh0TMaJDSnSuCqDrIEREg==

http://www.giftvaultnow.com/0Hc30xjnaJYn6z7uW2C4fYbXLJ5RTNIC GdWnlFpvnGo_ygiH4AnlsUE9 wsaPuddKSmB2HK5Bx1eY3Sfih2y6meaovUHHkr4pAKunKAZ2MXkLLn2YorCQRkiRO2kgCqW7Or2JQr76ZqJluQlzNYG98o3IVUz7wGIMwI9_1soJmBvEDdnhZBLrjcIQx1FB53gja4QKRbmu1sz9AA4QYjTGijqjKOA khjdYiVBup0MA49JYMVQUXHxJzHH1CzpyZBGh9s5Y1mF1uyj3DXND5bzfkhPxZC5No6MJYKmh7BEOPESJS UQ=-Gz0AAES3eX7q03XGXzEoqBJNECZy4NBCCUAP9s42DuSNp8Hpvr78I33wPTh0TMaJDSnSuCqDrIEREg==

http://www.giftvaultnow.com/F_vwBNyAi5zikecktH6Q7BJ1kwmRWTwGVZKV5viYh2kv4LP_fpGFM8CYj96BgTy0fmP5 Ryt2sR3Mhpzpwz08Eruynsa_tB23Jj_glRjoCHLKBrTDKAvBOe Oue4kOg8hCrVJzZ o2NU4UI88sdr83uVFPslurxU4ZTcxZkScNrueKfl4spUPGsa6QeOR24cYzkUmqD0UzqY_CDhp5JWICToMkeugrCoDrCa7H0ZXMZWoM4bLOzom6UvM5ctZqtybiSQO6ULdXRT95sFmmga_mviam48wvP5k7Fcaz9PM13gNjmxaEMqsC39aZOryF0tD6JbB5T_-Gz0AAES3eX7q03XGXzEoqBJNECZy4NBCCUAP9s42DuSNp8Hpvr78I33wPTh0TMaJDSnSuCqDrIEREg==-E

http://www.hostingflashmeta.com/c?x=lQuaNKhmP KD64SLn5L7xDSpIBNhNyNX6UOG9KPBtLw=&c=pNuBVJUyPjnhf1UFDuoFGdL0nVrwnBEpXuhzH3tMLp MVkQ5YbiGG5vboJFB0SMbHPV6hKbYQ5gUC/cbkec1OjPs /4UZQuKxKPOuwYoVbvb2jz1ZxAjoBWi2kW2dfjoGuvNIypOPpybKVS1MtIh3vSmYjEIx3dqoH brhW7dFs=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bulkapppresent.com/c?x=/Uu3bocKUQeDpRt8DpFlsb fGzbHP91c2p3dUCtFY5A=&c=n7UCyGeyNqt8RJk14hBBjJD64fBjP4PNxs0gQCjJjjL5WDE2pdbUV7JOWEbCn/Y7RGNHc60s4uiTWn4XIet2LFgg8Q4sOGXBX00ZXffCRlDdFLYLtYS9uwlXbGjDpQfEM9 uSZzgoDdV4RNL9G9T2a20/jSqHaOzdCyjQ9cxwro=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.tourstodaygrab.com/c?x=wcm8RGP8efMN4/kKS1 wa17habvt 8wxWWIzDYQC0OA=&c=DbcQqGHc41LG ofKXo0ylvNS3a 0lvyn8iyBm8VQij1gP9G6H90gqKXNJ6RZ9YT3Jk/AmWNSwRjpocsoiPMMRA27kfOKT08m fVP8UX8H/XZH9wdc N3r2ed723sr0IMuEsuTTAp1zPN2P5RlguLEnkNeAa/mkLT ADj1D8uGFAOpN6OPDAV1nvTHtMfEGdN&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=TZhtbWbxIZo8TGhG4LYuUphwnrb2OXEeisc n/wOEqA=&c=oHGGqFS ArFv2iIWBMq/FYiZmjxy2xNF9k/88f n1XSZAlZ21N0AKmp/tqg6YNfEd1pYszf7cg/ VMGGlv7tFEMCtZDJoJOPBSNnCWS/F75326nvQG1fx6/YysmO16p6t9zHUxAY6rAZ2/8CQUuy3DKStdxA7gMkDk2wLmcpX1g=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

Remove updatechecker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.