home

updatetask.exe

This is part of various InstallCore adware bundles and is designed to run daily and maintain the current state of the installed product(s) offeres (mostly unwanted adware) by connecting to a remote server for configuration instructions. The application updatetask.exe has been detected as adware by 8 anti-malware scanners. This file is typically installed with the program VooUpdate. The file has been seen being downloaded from static.fotynefadic.com.
MD5:
8dd46921cf37a1779377e0de360569b8

SHA-1:
de233df0260f80593f0a30b00036f266f1995eeb

SHA-256:
1a83e12b1fb3da948ce20e494a8992425ffcee406af3586014981e5d7fff70d8

Scanner detections:
8 / 68

Status:
Adware

Explanation:
The update task for the InstallCore download manager.

Analysis date:
11/23/2024 11:34:40 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-150609

Baidu Antivirus
Adware.Win32.DealPly
4.0.3.141229

Dr.Web
Adware.Siggen.31333
9.0.1.0160

ESET NOD32
Win32/DealPly (variant)
8.10939

Kaspersky
not-a-virus:AdWare.Win32.DealPly
14.0.0.1914

Qihoo 360 Security
HEUR/QVM05.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.UpdateProc.K
14.12.29.15

Sophos
PUA 'DealPly Updater'
5.14

File size:
799 KB (818,176 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\vooupdate\updateproc\updatetask.exe

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:hiZsYFebd4W4n+cX3MaG5wHvLMLiKzG0pjejoJfzh:EbIbdA+cX39G5Kj2i0Gajei

Entry address:
0x616E0

Entry point:
55, 8B, EC, 83, C4, F0, B8, 40, 15, 46, 00, E8, DC, 57, FA, FF, A1, 04, 2F, 46, 00, 8B, 00, E8, D8, A6, FE, FF, B9, 7C, 51, 46, 00, A1, 04, 2F, 46, 00, 8B, 00, 8B, 15, 2C, 1D, 44, 00, E8, D9, A6, FE, FF, A1, 7C, 51, 46, 00, E8, C7, FD, FF, FF, A1, 04, 2F, 46, 00, 8B, 00, E8, 43, A7, FE, FF, E8, B2, 30, FA, FF, 8B, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.8910

Developed / compiled with:
Microsoft Visual C++

Code size:
386 KB (395,264 bytes)

The file updatetask.exe has been discovered within the following program.

VooUpdate  by VooUpdate
About 5% of users remove it
 
Powered by Should I Remove It?

The file updatetask.exe has been seen being distributed by the following URL.

http://static.fotynefadic.com/.../VooUpdate.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-23-21-92-35.compute-1.amazonaws.com  (23.21.92.35:80)

TCP (HTTP):
Connects to bits-lb.esams.wikimedia.org  (91.198.174.202:80)

TCP (HTTP):
Connects to 3-125-232-198.static.unitasglobal.net  (198.232.125.3:80)

Remove updatetask.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.