home

updatechecker.exe

Application Installer

MICROMAX STUDIO, S.L.

The application updatechecker.exe, “Application Installer Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.sendcurrentapp.com and multiple other hosts.
Publisher:
Application Generic   (signed by MICROMAX STUDIO, S.L.)

Product:
Application Installer

Description:
Application Installer Setup

Version:
4.0.4.1

MD5:
7ae50688bd415e0e06b62fcaaceaddb6

SHA-1:
50daa84a7a92167274d55fa6cd78265191b5d279

SHA-256:
17b4aa192eebcb8eeef45d3eaf76ed0fff6a00d1e74f4629e413c82096083d5d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 8:47:37 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.1.15.17

File size:
916.4 KB (938,344 bytes)

Product version:
3.6.8

Copyright:
Application Generic

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\updatechecker.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Zv//uCoylpB8bnLLFKqe+PO4efJOVGykH:Zv9BBSnL4kPrEcPO

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file updatechecker.exe has been seen being distributed by the following 16 URLs.

http://www.sendcurrentapp.com/c?x=YvaR5plYOIG4WEZQPzrH5ZsNwvMWDAn8V4s5kWHDx8Y=&c=yttJ2Hm4EP08UWaF7/OG5KARCaSPomuujkwyDqr5LU5N4b9W/QY1PWRCuQ9NvszKqgPv33ttfGUuEVdDHk3J XZ3QycDOQ2QYjT4cN gb/6PRmWyps3DCxCZz2QK8k7X&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.sendcurrentapp.com/c?x=XLJZYjjG/ioGU5p94lnjJcxXsj0KFZKKn8Sc59nV5uw=&c=FXtmr9mD/1lGCitmDflk1KP6DXAfQq0Rea G0FPRG0700LZTOuR SmJwSSXjDtp9pXtdYZoeF1VaovQuVBffQ5MWowl4Nvdccg39NxNeugGrSR2oSUPjx9dLGtHFPnb5&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.cityheartsafe.com/c?x=PfVmLNAWVAdqXjOtYjLgKI2bec2b 95 vMZKzm5LN Y=&c=V7i4jGrWOfzre5NdPZLZgghaj0LJmSeDbL2JP/kSikgB6vCjSbItmTKJ6bN39t09HBrl5yUGekvZKq1Qk66LmtQL 0K6QUtyCrQdOpVO7ibRUGcDkfsCw3nH1OCvpMRI&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.conceptshostsoftware.com/c?x=hzHT4P9zrAKst5KUNYr/D9GkiooccvniAFJSFjAzd2o=&c=u5hhOoZxa1wpJjuxRkw4E SwBQlQSNn6G oR4XxZMsIWcDc0KyUhNSLEmAp J9w01WUKSjZeP7JnZu jz9 A8z9ADUAWx0fqE/AorJIDXQAJqPjmeTZnzzE0XNzAfmCZ&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlescurrentfarm.com/c?x=TzWb4ryspnZJjZF6ZZRciC1oLGYUclkgGCLy8iEwWJY=&c=FXyymx8FK0INNNYu V yEpo1/R7D/eSQ6SVxffAp1k m/f2e8Om2ChqbkyVFoA/Urkvhk1wiFcTkRtZBbJnCfa0qonFbdBo65JQYKPlI5dLib wJv X9rmQ33lTfmpIp&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.centersignfun.com/c?x=vrzS57CSNYChBMH8eCIWwWrreWcGcWcZdLLWG80jGqk=&c=R/wQqbi47XIWHY7Js0e0rQIUUx4iUaTOH9jpLrRud0uajBEctJK7UssU B9pqlV6BrPsNkKtjEPmLzvrgZKAl5aA9jF1OVGCnXFldKUeuswllTcPmRIfAIW4XFuyceug&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.apptoursbundle.com/c?x=Wvo8lc64jyrw/LcXHE4Oew4hiIlofYr/Fu04Nc6StiQ=&c=wScAfsaAwazNS7KYWL0xra/2cPSJr6wqH03m6CzVM2ZbRXLnurPHo60VQSPqfl5DeCclFG/HvXxyGa3nf6VuQ TOktJJWor4/7b7KVcWHKTwmG7W5C4o7DDmINIUOiCO&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.purepackagesthread.com/c?x=aXR8VRo0WNsG7BcjdsvZfz/Gg2koyQAvTYTF5mAJhjo=&c=8YlfTVLFugYP44QNwsmd21uFn1qPQMcIzQFrsrKA9bOwKYEeRFekukCUfbbWg1V8J50uZ8BrnkgXhNg9hRsFBuM6iS3ektA O0rI2YzpJZ659105k9U5oe oPCnALqPn&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlescurrentfarm.com/c?x=RfA5FuH x/zP82VzoP4dkYXXWQ25IhQ1cq0shHVAhCY=&c=57kXYDEHyERcKq nNJCS5tTNr1Mddc1Jv4pgWiZwjSa81vnaUM8g8LhiSOnnUz8DJY 7jSLuNqGYHZnHj26IvgewGP5KWhBwnhqBAJ4SLOpYLpWqVfLdyIbK7wmhDQMT&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.updatebitshead.com/c?x=fxQSBnhTHq3mnZk0pU3WkC9Q60/LqvHs4pLP6YqISTo=&c=SC3IlLCoqalURlzrDb4sCsldJuyxkDir47bpRs8Js0PqyrzEUM9wjWzIfWp7/ v0Vs odCQRA9x6yXa2HPhvswCXf7qYh9nPKyREsH15aE/FirDQGHHX8trUpMTm/ NE&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.applicationspresenttag.com/c?x=CTjWC6M8Q07y2M9P0hsptixOt3Wqj1fXfxeFeYc5cKc=&c=Qzi snQAPc/Z2Y9ay8gl4pxK4NzyIUnVW2HGNTgh zQdvBXsuZQyCDiTILUF9PecJF1p1NU2ohsBWlMSjiLv VkNzEmM5hs6 ifPVKeuHdaMHVGn6pb9/wyzigg/7cXz&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.hosttagtours.com/c?x=uig682hFmePgheGo D4abbd7PiD0ypW8PFfrJkd0HCA=&c=LBf6yw Nyrg2WbSczrQ6 X 3dMjvgAuhhe86dwMV0iGupKLDl5AVQm7VzGXH Gy0mhfNrraJqkav8Ap3xCLtfCymvs0iB1E3fvDQ59FrjYLKcJHymvEOiHs5LCtk wyU&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.toursstockclean.com/c?x=4lJR TgM5RBjGbrWZv7TjyTiy9EQ2BsTDO/xcZ9JD9U=&c=qyfNme2RpY4AgL7F7qCoDfhN5Pu92X451AIslFPMafbg6rJvgfSDc96CVOEk5SfOp573KH02pcWaw4KXDdnngwGzETLGtQKBBAkW3TAbqUsywc7yMjg2LsBPBbiFs27S&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.hosttagtours.com/c?x=hrpkavFVyP/j4GevVu5XaJY8lcfQX9BEYZHcHsszN90=&c=wjWxLcD5F9wU7d/A3wnF9ctYP46 bXwcKIH1IxTeLokpVhWW5tA8u6/PiAAG3wVhvOtQCJEGdA8ouvFlccwSZadXHKJVuFSxC1RwtQF5E3eAt3GS0t4KCUtRD4Sl3YKr&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlesclearmega.com/c?x=A7e4MN3yOhIkHY9g q2iM1J89Rn7a/Sr1pi5bNlPm6g=&c=OooQYA815jqappUcsPauVQzbdM4u4WBeR1wkpkHToJi7q29LHDq1VWmw/Nb7QFf0D3flVtETNYsz1mjEv6YTaTZalmZ/0lA107PA6a2ywl8YSs6S0RJqOr4da9VoS5ZX&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.purepackagesthread.com/c?x=IHapHcPjIU39k8lWQF97PY3L1i4uZwZHgpT1HjXIkTI=&c=Pq xu28MLmvGAFh24YmuBdC9zePVwYRxaQQqx6VJZXOWyR xM360CIkWbgL3izJn5NIS04DkrpjCe/jxAS1Dngx/5uvRQs2pub7drT8nf G5VggwbuaZtrWvdjy5eB2I&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

Remove updatechecker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.