home

updatechecker.exe

Mafelobes

MICROMAX STUDIO, S.L.

The application updatechecker.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.bundlessignscurrent.com and multiple other hosts.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
edc90de148f8e02e171ce7b455506840

SHA-1:
516792281cbc215dee36515771baf9ab5c1193fd

SHA-256:
88eac3ad39e7cf0f6843615306f931c61bb5f6d64b3ee4a1f3286d1c74c267e3

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 3:02:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.4.19.18

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\updatechecker.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:hzJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file updatechecker.exe has been seen being distributed by the following 24 URLs.

http://www.bundlessignscurrent.com/c?x=yEhxcTmECuDlBTzYMMNuDqRP HK WrT8x/yiRR7D40=&c=D2xr0p4mceekuEqCzZ1H9KFgWfSjG0lXJ1Goq5oS9qku1dPfa6cyJtqgPvdi30S2WQfhChKrvCWSIxTI2uoO0KOKCjdq3u7CD9shyYHjUsrf95fIW1CI1vxyU2TOOcX4f07vsSAZxTe3amH2s9vgfVc9SWRrg0MRI C/jpqIzHISarT1PCMar4T fG4rq0SD&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.townchuckletours.com/c?x=PIoSdXVpq2RV6 lTjeL6Lge4PiSavI8dtfIeSSXkTZY=&c=k/qhdJTjVhUnYPxNVU4Yt23vDy2/gO7Db8sRJkmepI8UB9B5SrwuzCswqfM4iA2x7oL kCc/Cn0k7XX0j8AEdUkv4Mzc3KMD9Y8RlBIe92apOQo4Nzh7ppvQzMawRrYA8Cd5 d4phXvDVo58IEKmesVYI9ptd0zhStQ1ASH9iio=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.gifthosttours.com/c?x=hgd6Eb3vr30oq2L/BlD2kTL/YGx0 kQGnwWqZy2qRXE=&c=YrmhxhNIC4JDg 5sJGE8pn1Rzyg5WUyoBP2xrbt8vFLq GQD5q1PNAg4lH6Xq5kDCE OrUdS1eb8zmduJrB1KIGzENxlz/xqnEA8AZ5N04MCLhSuWt15jfDvVwzrCIVu4YgBtJWEhlx9lwYlXoYvgIEs2UuLlwHRe2bP78Rhc3k=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=oKt30EBq6GVYSoSfgXmNEM6w2wPs3/TB6jpSNaEue3Y=&c=N5u3O4q8zrblZu1Xg8MW8VvEo3rZ33ntKIapU5gg6lz3z59vFOa8cqTNQk7aFujY8a9oze/Qssj80iBh5WODbDnRMDfI3pLyXQHj9x8PP /jvxcc2fkVuSQtUsG6Kdk0l03qyKxuf/h3AC7xn1DUgR3mt7kPyfd1d5BhzvuyEarlDFl7kX 5jlB5WZxIlIV&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.dlpresentapps.com/c?x=g3z4 PjB5ycQf3g82fPkKZNrsyxJf35EsnfzqhPHiiE=&c=V8A0RjAwzwvXyKCebXxsMMcqEX3peClqufKB9XgElRVGXyJn7PyQk5b0DDUIuHfXU94EkPiFnoAo tkEp4jeCq9OIe7eKCKxntUAnV8MJKkDJWQR1lvZ5bScEks/zDhgda7HGVIqXs/6P8S2gNGvGroqtgDuZrWqKo20QXV7YmA=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bitsbytehost.com/c?x=G2Z/vOReNQNKFcrfyzUnzMkqmrQx5SvWhGqgiyERQmE=&c=RCiDP0PvgRvRM1xtPYe2HW2cXuEmvk9CCVgak5CAgVlb6aNxV2JH5z1iYPbjC7/btWrAg4hMmBoiGvYef7TwcmAyjXdjKg2aF/cLZqtDE5hFCO76DwtAiYHO5Cikrgh9s3jC8ADTHJTCu4RCdUOzUARdg/WmdHwLZU81vV7aIxI=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.hostingflashmeta.com/c?x=EfHaNbRPYmDR9XaNAmn0cWlOz04zd8DzOPBL734E0hI=&c=aYXp/hJSzZWipI58CIT71joWW00W3djzEU0 hLlOys/5YgnMPjyojTKFYoz9pIkLJkhLp2giopUaJU1vhslPLVunYlzptyCCKnLajRZ5XOP0MskQ2mHCmaBerIiZX4GqEOSLGv6QN4uIIwRNkWJg03iPFOp5aPMIWjZXt/fBQyo=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.contentsignssoftware.com/c?x=DmszWS9SkUGneYcKGhaSUgLlRDh1dcUqPP79yO5t3CM=&c=NsGdroSn0qK4nUtg2/sZlYGHb fYhHZr3RBvmfDXErCT0Bk9 sZJ10EdfsWin0e494gXozcXqYvL8tXQuUmHpa/vdSqBVvJdEav/wlQtcjKRPCaroSkaTQ4dZILggFAxppeVg7aGfJBvnk SCrYQoNysUdOqFNg5IFt8n0dhPAE=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.cleantowerupdate.com/c?x=k1XIc9K6m3cenaZXMX2Hf5G8gOMn5e/saN3I3yUEnus=&c=iIbIk4tQMYJ9NGdTRW8Nu9wrKyqTBZM 569BgJX/MlFrdMO49YYdGu6nFJRA3KNNvLKPoy gTWLLyhYXhnYJo8B98iMam0Pp4cVx4yOb4 NoQpckqKV2DgM5OgD08aK2DvwjaKfV8FB3VrTbyCePu8aoZ Cwx4eDlsggB/PHKkov7uHfc0QYRV5sIJNt3qk3&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.clearcyclelaboratory.com/c?x=W/G0q/eKhZS69moNNDWBFqGPsIPcpf9HBDoThIU6pvw=&c=jqD0NCvey8ABQ6q2h28QRtaZW7M9vKGLTfM2ojFHmhXWjqnHr XSKStEhgHrt9yxqgE7c7KgoyRqaNWdaohAEtm8YaQMIpgCZ9HZL 4BklNTX491lS5Hkhl3oZlIc24Qy7c5s2J7R3k1ry EQty5Anmj6nIS4P9AxWXCD0xLun4=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=XUYeVXqYjkQHv7kv4GS3CHRoAp39dmMn7yAe8AWX4VQ=&c=9N1aayd0p3RPNRcYfc4tfb5w9wWEoobs5cxDev1WMuJzaJ9v6RsXbmX45l5AeiMC8XoVSfQPbwdP4nsziBXVwLme/6r8nYxK2dwsx//Ee95ja/Mk30Ds29bBDVQV4JpeA1QftPE864zDgjSDEa4fT4zTD7XyWeLJZrmxFy1 gtk=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.hostvaultcycle.com/c?x=kr8KDN58mXsPIvqQKA0dQ0UsK91jj0xo8mUYGIrLJW0=&c=fxnm5SzTn6/mNb2nEMQT4JSnAURJ17t4e7naI5E27KDTou0qqd9JSUVZ2fQ9Pyxyjnvz sz9Y15SkxFT87y9ILYekaxnF45Mw JyVmbGh1XKQ2D/JQEhxU1Iv3V56aaxHZ8CTNeCkVSCbuoju5 HWo6VJ7kvqNdvE7HUF6Juio=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bodyflashranch.com/c?x=CNniUCzef0X9qQdJeZfhYoeBfWy6I832J3l9lCJengY=&c=nAtrmZ 9 5kE5XG9UQD1MaJk4huylwrWTr3DKxArh53lIn25PzrADstvUOyj6ygykhjq4 s4Ax3mAGHrSCMdccCMAZd9x3J58IMXeieGoaoYOBuzRQiSfbGgXy/gBg9Hjm7jOvfd8DdSR9WKtNbApJdQk0UeUqAwUc8YBmMAMH8=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.hostvaultcycle.com/c?x=G7dPhqXRIw9HJcGPkNZ55qS0XSbE RzegDOUAM7vZcY=&c=aqBbuxZEv3fzgLwk6hRQ vgXZXxuxcXj325ZSj/sdbdOmKTJINQ0FzYp 1TTHKFa3PhYKjLJhr9M5fjG fJybm9aeq5lzRoaNN p2LJI18LyNHY 6dtRorpjTRFjL9v2NbMmO9ZwOWkhFqZ4c67gZBYwgesl5fJsXS4IJJsuQncd8zGopEyDbTsL IU2MgDI&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.safecapitalsend.com/c?x=A IfVn4avIgNOgSl pG4TFXDRZD3Y 07XZ2pCpCfyYI=&c=c JEYECcvHTraabITMxOHBEhUJnFiQt1sBq5Vg/7ai/7/lXFTZgGhvnqfNrJaEUU5T3ft5VTmyOZcXEFWKpnRcn4o3XgDfqwpSQjlKVYXpQ fKEoHm9YzzRJKkfhBBC5cuykxtKY9jNSLnbqBiUqx19t3t0BMIaxAm1fxN8aspA=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bodytaggift.com/c?x=q/Ih /itYxZwF5qNj67CZvOa4SMuIyOxEP8RxGFKdkU=&c=0ni42hHXngcZ8vlY3NCqDTsNRsslIA5/XMG0F8gc4 wyLGEAmeYdyPInZa3U8/gZNAgx3jDWbFqbnb2HUCzjpDXgX5kJuurvDBEEfzB4b 5 HnsUFWVuNdtqA/5nO no1Sw7nBwAsrwhtwZP8OwiU 9dN1u7lwTFT oQA78Kqb5HeeJPJBKxfA G0vXk9508&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.appfarmpackage.com/c?x=otYXNDekhftFbtq8VNip1ekmpLslWOKUAhwh/97Ol68=&c=jlKAxvJjlIamS9pp4BY6Ue7i2laC/aZi1CxYWl5RYnVDtWke9O5rZkq1DCqKmHWwg/LdwHFMh8PBplyGvO8faQV5CMu9KgbJOrbXhEg7qZGJ/sd9iF0J3jMprB0gRe1K P6IL5Hw4xxzf3XXGzVWBpUD T8weE2RAGTBZx8jqdg=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.packagesharebits.com/c?x=3141GncCiB kvdY9TnaBrO63oe8fhKrVdX95B90W5sM=&c=aZtZyk9vgEozBxDByl0C9N4mrBfVp/Ihqf82PV6HIP2DscDSxxz4rSAi1khMXb0lmFSFN1xDQ7Hv0CqXofXgQk1kZYNG49cbJB/inRW8GG2k2tdnTMe5c4oPi5C8TwibUP57OSCiBOwEduOAapShbDHVsA0pFr quMIdwsQ39liOitV7oDBpGeAemn 4vlqf&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=3MnOWBA5Hb/IxC0/a9GD0Xa79jM7rm2/OetRynDsdJk=&c=qU2BNQIthri4yqlS/oc 42Pd97A/E8TUK7/V4BPTSJQqlLkmuC3fvyhs1L9LhbdLo5Mq2UsLuQeFaAZiZdwvs9kvA9m3qW683FmHbt44EDtkq7anpNPclXvdlpFmKllTphegOn0MlgRVp54xBeV/DIYbpMgBLYddI51K9lVf4zI=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.nowtagheart.com/c?x=eYQpKoSA21WHChKVXzNz/oTkx3IgeDHczzRsFRdqBUU=&c=LqvB32 qzJ77tSoOHYxFL17GADdBDGfnGd1fSSPMBb8gI5QmD5W4AgVpGf4BTnjDKSugZJnSZbR8TF2cSSj2g9tzuSS3Ll8yehpMjwy5fzqo8puYiAQQDjj4orRdGtHEpwNBzE5K0aMomEZ25xVYRc0A7OKc0HQqYWmzKsC1ufY=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=SN7eyuUtnguG ahpvTelOGoeeTAkAZcCmWHRMJ6rIag=&c=01Z2KwUaIFpX/imSjCiJJAXGzjcKmT6iRegkEo9lzGKAI9uUB0hm4r6GYd00SpMIsms5hrxi2MtNpUj8c4BsEHnrV9uz onI0vmaaMIJrL9HTWqPn Eno0m6Ta/jkYvRuG7jmHajgL ITSXMBCwRcrub5D1wMaIroSwbmkGpQi4zJa19AAuQ96IbOhPpJlOL&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x= BqRygaRlnyeVonrOkS2zLo/dNfg1z78 uffZphC/YI=&c=FVUBNOhgoS0gCB6knbrEORLeumLMhtGV4LDVTmec/N3MgY9IN5S2E3NLw6YH/2jMt59dPNSG0usEAb84jA3Dj50Ihz fi 8DaZ66Tjv/jaxabp7wVZSVQBIImZWVXKsiOmYFdSRijgHDhJEQ65Kq79pqa/2uYYWd5q5A6mROMMQ=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.toursclearhost.com/c?x=rKv9R00vs0zBHDt NA5kSBYtc38V NQADio lvhbCeI=&c=DdG98qFIT81qKjEr6YAvZzKkzGlE96bP1sGuyoi5YichZ/1b8aEkVRWzc71pBgb8ArSRK ix7w2SEvZnCL865UsTONmT0tWv81ovAytS4uQHTTlMQXcwFysD/tFud6UB/smHMZsS5k3ZViQXF6k3l3aa2k1GQVxQy Nljx8sDE0=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=dkF 2Ffcb4gYnhdXm8TIa8eU5IBlS4jXbSoeDMEGgmA=&c=z13kwKQ46gCVZa2fzjEPPQnl6/Y2GC37VQqA5mEaq5VYQG0eZ3RPDOoKI5gPhPo1ECE62oh4WE81gY29SGuklJq5TQDZHo3c8h9pb385sPJvaWRIxPCqI0J4fJbEoxJGOwXZkuqPl5mpKtv2wrYMGPJyb/i9LvH0PRyh2P3qSPQ=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe

Remove updatechecker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.