» updatechecker.exe
Overview
Analysis
File Details
Downloads (12)

updatechecker.exe

Mafelobes

MICROMAX STUDIO, S.L.

The application updatechecker.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.dlpresentapps.com and multiple other hosts.

File name:

updatechecker.exe

Publisher:

Bemadetuso (signed by MICROMAX STUDIO, S.L.)

Product:

Mafelobes

Description:

Mafelobes Setup

Version:

4.1.5.1

MD5:

92798c9858b4ed49da7405fe9deb566d

SHA-1:

afdd046c70e04aa25585e7516aa2e0777d4ec3f6

SHA-256:

93f641ec0fec2770d94a6665dabd0f22470bdedcb2388e3574c17f939d697078

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 7:46:50 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.MICROMAX.Installer (M)

16.4.16.14

File size:

942.9 KB (965,552 bytes)

Product version:

2.7

Fast

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\updatechecker.exe

Digital Signature

Signed by:

MICROMAX STUDIO, S.L.

Authority:

GoDaddy.com, Inc.

Valid from:

9/1/2015 11:11:38 AM

Valid to:

9/1/2016 11:11:38 AM

Subject:

CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

79A6DBFB5606456E

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:CW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:CzJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file updatechecker.exe has been seen being distributed by the following 12 URLs.

http://www.dlpresentapps.com/c?x=6fzYWwOzUaaXNNzSiA5YVua5Q4Xd/sDnH qFaW6B3nE=&c=QcLKwJoAcs0uM3cyShlmPJwwTuXqnOu/aYg6cuF2vFoFMcBjtD/Pmu0pMvvFcXRghMgw7tKL5ot5IzpD0PauZ0o30RFDsOM3wLkb4ysROXW2wrNCNdU2SPxPM2GblVaZppJTjUvZPCorKijilVTHfxiJFX4yzl76rtfRTlf1shE=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.gifthosttours.com/c?x=TWT7KRsMsb8DftVX40 J9YQPS59x6sd4igBf8H39Asw=&c=0RJnij1RKUAqm1eAyRK9hqs9vZsSPyGCPoGUxW3cBcOaXJ8xp9apwvL167vVu0s6EapDKycuFoSFBtbuaYD yqP0j5Oq1MndfXKBQaPFnnmR7xQQZgNJ6AcVJ 5gKEaIUn68QXShBTb0TPQJ7npE29qlWvDkUKnhn4pBpbMFjxs=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bulkapppresent.com/c?x=JKIoZAoIh2bmdWu7oDKtNj2a5Q6sw70JQz95FDpEwyw=&c=FdoC3kauVPBD8EqMSVBK8QK2hPmZf8xCzK zjkvShzC eZ/1CTLvcbOnzxlCgt6Nqw/vkpGmak1Jkq9IG72vOwBzbXa5BbEl5LJ8kP0oTAkBcensthYoKJQc5OoICzHQ0ro2WxlnsGKb4u7 MQg7604EInfb404iwNRcnUCXhtI=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.capitalcenterfarm.com/c?x=nX2XfgBJKZgU/pOnDF4qtzttqmZuHtLD4OXTOSWWzcA=&c=aBoDtlbj1WdeuOF5C4t1J/nrMk2rjtLaw7d602zy6D6ne8wl6cMa32D/p3 Shfx5X5KjVeyMeqVgR9KrBKYueTSRm8fenVGbsI6qNmFHzAWLBCDImK0qPXkxmUiGJE4SESkibsXt1GoukyPTK4bw/lawpcucxAPgj gLrymFOpM=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.guardappsconcepts.com/c?x=OAPfl0XtKuQlZkB5Vt0d rt77f1 kdhUeKZRbcsOzWk=&c=ee4KtWewynpnBNsmp1//K4Lhl5v3lY8MVB8dXUP/3gjC1Kvhh4UHSTrvohGvazOwIzoCYcogwzQ734C3VXto CIyITkoqXJKxczwe6bl4jQFyTLRs2cLLsB1WdtTp3aGTYgBnyZ7 5tHFtdPOq3mvlGze23lXqdPQDHYl9TgpaY=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.guardappsconcepts.com/c?x=yCAIvhfi3rEoDg1IQeTQbLZxbYv96kuQ4eeKgacV fk=&c=A7wBMnh31d2K eZOnY6G/cK1OTtvVJON6kho8Qx0UP0ZdrvNK1ztTNqEvihXWxy352H4Mt6w1lQPFFaP abjmaBr5 Tl8n8xyuxzVYeKWpPoAiEAWJu2z8V5vP9Ih LhXN4BXcThHX9qZWtlAeCNCujbQOHXJqhfMYK3xgoBkyQ=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.packagesharebits.com/c?x=AuLhloEYgzB9OF1kOajoiwUBzJNoDsmgE LwzGBSN c=&c=acvoxAAH38UmCT3pCxlY14B1jbBy5FE94jGXO/FtPjv2Q1ZA15mg01tT2aARmOV7yFaQ20GrLVN2MByUsZyqs2ZPmlhrhdTymrCeWPaavFJKnFKeonQkWQ4zI5VDcQ4F3O fRl8Zw21/ORVt1TRgJX9iAaqvGsfO9hdYxUkb2ygRHItjNvnxP1z830SFial6&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.towerslaboratorybundles.com/c?x=eKenTYA1RgxrgWcGUS0SASxm5GvBE2wYyzlNYKtPSXE=&c=BtRqDTlasHvoQSIsmS/bc3e67eaWBNkp26WuqyNLll/xFa2CTaGV8SdkiY7Juuh9mf5qTXAWsds9o35m89bkQ9fDk2dUa9nEOIQvAP1uF5W//ddhsNGI3uQgWvHxLdkxfZKWgX5RQYD7XbYqXvzVGs/7rJrtdmqIckMjkNUw8SE=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.hostvaultcycle.com/c?x=wFQfvKy1PrmMDNMAZLjiNx5ZjLUhOMqUGCiVBm bqwo=&c=JyRAgjSNsPML j7mYsO6I4rZ3qkndNDxLAtpt90rg0uPAYhmfYb5CxBRmhJsLT4bof5yjI2zTbkZKALyns55cykLdFJB3v5KXRgkNduEU2V9/kkcFamieZSjo9XyTwdIwujiJ3q57/MFzg3JU4f5rrPUeWV/sYNyOiJ4I6/bY0Y=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.packagesharebits.com/c?x=YBMkr8gJsQs4PepPgwS8exl/wWc/zQKE/dKh48rAbDk=&c=JUNVzBbFnGdsYBD17jC6sOsrPg1k1oLvL7 tWQHPzvDCR9xvx0MDBUILNp9WLDB9xfqgJGp6HKxeNrOE0eYPm/IPT5FBPvJXw7IbfFZWLHw3DaVKtfCJnokcq1fFZcFSsLQQGPo3pDA1c44xR6b2QY rE/twz2L2CX8PYbcIVikmtMbI/0mYKfoHZ9fVpPkk&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=9iF2y/d1YuP314S9Se4 aHM77Baj2AG2zCwElkqMZIo=&c=feHefMG5LUruuRggFl7vMncxKOujypVT9d53/qCVfFrXXXUpMYAVanUFL4qFfzDEYSyPFBDRQKz/ebKmcqHMNKbub7YUqoG1eathAqSJZrju8nK//mSPL7VElGkmONy4K 8mQnX sra7fis7nNBxXgCUIL3cGTVbAUkWfkJIaL0=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bundlessignscurrent.com/c?x=kQ45T0zNlx/0FWzOETRRylIlsRUY5WMvtAfyr4uEn50=&c=zRWFS2l1oqJf/fpp jWpC565P7sAx0wdt3uMaNa4s7sMzB2RXthzp3pyyaQlSLsVbw6FHhCTsa7T6 Q gXJezyPgaDjQCMtEjO0KG5HZ9vigsq6Rw7ns2y9nxQ9qGL7XWXoPdFq/Z5va0XTXuqjxVDHzRH84LKRo3ZPj/qYWFqA=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

Remove updatechecker.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.