updatechecker.exe

Mafelobes

MICROMAX STUDIO, S.L.

The application updatechecker.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.grabtourpackage.com and multiple other hosts.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
665c7fd3584659f4d324e6fe7dc00172

SHA-1:
e6ea725d16846c678f7ad02f8fcfa3198919e032

SHA-256:
f085f5c95352cb530316603273b4c671b981f0c5c3cf62ae6c7171283e8540d4

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 4:18:23 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.5.11.2

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\updatechecker.exe

Digital Signature
Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+W2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:+zJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file updatechecker.exe has been seen being distributed by the following 24 URLs.

http://www.grabtourpackage.com/WVl6OTRQVGRzUlZWTlJFOGxNa1lsTWtKUlVVMTVTbGhVSlRKR05uUnBlVEY2ZEcxU2NXWnRiblE0UlVsNmVFTlBWSEpVWnpBbE0wUW1ZejFwU1VSSlJYRkhkV2c1UWtKUFdWRnRlVGRzUjNVeFVVUmpSVzAxV0dwb1ptaHhTREZuTlV0T1EzTmtUR1kzVFVaRU1qUnNhMHBsVkV0VlVTVXlSbXhCUTFoTk1YcGlOaVV5UmxwUFVGQXhWVFkzUm1KcVZYZFBkVFlsTWtKTGEwdENNMWhaZDJ0eU5HaEtVa1pJVkhaQmEyNGxNa1ozVUhCMmJFeFNTMHcyU1hGV05HSk1UV04zUTBobVdVd3diMmxxVFVWME1qVnZNMmRwY0VkM1FTVXpSQ1V6UkNabFBURW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWnlaWE11WlcxcGJHNHVZMjl0SlRKR1kyRmphR1VsTWtaMWNHTm9KVEpHYjNCbGJtOW1abWxqWlNVeVJsVndaR0YwWlVOb1pXTnJaWEl1WlhobA==

http://www.centralsendcurrent.com/WVl6OTRQVEpZWm5aRFVFSmpSRFJSUTJwM2RFZGtSRXcxUW1SSE1Fb3pSMFJLV0djMVYwZFZWbEUyY1dobFUxRWxNMFFtWXoxRFlXVXhTVmMzVkVveVZtNVNZM2cyYlROclpsTlNlVzUzVnlVeVFqRjJkMGR6UlRWdFYzVnVhbTBsTWtJMmRqTkdhRE53UzBWdVEyOXlhMjQwVUZRbE1rWnViMk4zZGtKQ1JWQjZhamRCYzFadFNtbHNTVzlDT1hGcWIwRmlORGMxVkdocGVtbHdkSEpyWWs1TU4wWk5Oa3htY1dWVU5HaDVkaVV5UWxCSE1XMVJiRTVaUnpKb1F6aEtlbXh2VkhCQmVVNDNKVEpHUkZwR0pUSkdZbkZ0TmxFbE0wUWxNMFFtWlQweEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2NtVnpMbVZ0YVd4dUxtTnZiU1V5Um1OaFkyaGxKVEpHZFhCamFDVXlSbTl3Wlc1dlptWnBZMlVsTWtaVmNHUmhkR1ZEYUdWamEyVnlMbVY0WlE9PQ==

http://www.gifthosttours.com/WVl6OTRQVlJZVTNGVVlXVXlhV3RKY1U4bE1rSjVWM1lsTWtaSmFYSllNR3hzTUVVbE1rSkpZMW96YlRsek1qZGFKVEpDZG1wTWF5VXpSQ1pqUFV0d01DVXlRbkJYU1hORU4wVTFVa3gyZEZoUGIweERTbmQxYVVKYVptZHJPWFpOUWtJbE1rSlBabUZpWlROTVdUazVWRUZrVWsxRGVsUnFXbVpWZFVkallYbEtTRVpTUW1nelFrczRjMkZCY0Zvd1lVTkxhazFTUmpFbE1rWlJZMVpYTmswelNYTnJVMjVXTjJkUFRIbzVWRVZHWnpoamVERjNkMnh2Y1dOUmEyRlVXR0Z4U1dSUWVESjFXVk0zVlZBelV6bFhhMnRwVW1SaFFTVXpSQ1V6UkNabFBURW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWnlaWE11WlcxcGJHNHVZMjl0SlRKR1kyRmphR1VsTWtaMWNHTm9KVEpHYjNCbGJtOW1abWxqWlNVeVJsVndaR0YwWlVOb1pXTnJaWEl1WlhobA==

http://www.laboratoryvaultsfun.com/WVl6OTRQVVYwVVROb1dHUnBXRFpaY1RjNVRHaHVUaVV5UW5Cd1dIbGpZWEZoZWs1SGFEaHFabEF5ZFVwMlFYVkRUU1V6UkNaalBWQnRNSEJXUkdKQ1ozZGhOVGRQU2lVeVFtczVjRWRaV0hwcWVIRnRNekpYYlZSV1lsRklOQ1V5UW5jeWFUaHliMUJrZDFGeWRsSmFiM2xPVUhKdVoyNXdiV28yYlZack5HRlVjVzlSWmlVeVJrVjVTRVZsUTNwNVpHTnZXSFU0WkVReVkycHBhRkZTUlRJelVVWldVRzlwWmpabGRtdGhiRmRDUm05NGFXZFFRak5hVkd4aGNHTkhTMlZ4TUZJMVJGbFBWMGxOVEdJbE1rWWxNa1p6UmtFbE0wUWxNMFFtWlQweEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2NtVnpMbVZ0YVd4dUxtTnZiU1V5Um1OaFkyaGxKVEpHZFhCamFDVXlSbTl3Wlc1dlptWnBZMlVsTWtaVmNHUmhkR1ZEYUdWamEyVnlMbVY0WlE9PQ==

http://www.dlguardsoftware.com/WVl6OTRQVXR3YUdkd2VVOVpKVEpDVEhOQlkycDBNWE5CYm1kNWFFdENibGhWT0ZaSFRWQkxibUZETkU0bE1rSkNXVU5GSlRORUptTTlZVUpsVmpWbVowRkNlVTAwVFhFeE1YQnNNbVJoUWtneFVGVmxXSGRwVUU1VVpYaFBTamROWW5SRVpIcEllV1ZUU1hGV1FVSmtlVkZyUWxWT1Mya3lUbnAxTlVaVVVYaFJORGg0VG5ablZVZzFkMG9sTWtKWVZXUjBUek5TYVZWVlIyZFZVR2xoTlhwQ1prTkRSMjFWY0dreE4zTXplRXRQTldocGVWbElRM05wZW5BNFVURmxNbmhaVjJvMVUyZGtNMFpxWmxkdmFrRWxNMFFsTTBRbVpUMHhKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdjbVZ6TG1WdGFXeHVMbU52YlNVeVJtTmhZMmhsSlRKR2RYQmphQ1V5Um05d1pXNXZabVpwWTJVbE1rWlZjR1JoZEdWRGFHVmphMlZ5TG1WNFpRPT0=

Remove updatechecker.exe - Powered by Reason Core Security