home

utorrent-win10.exe

Hamonog

FlashSetup (New Media Holdings Ltd)

The application utorrent-win10.exe, “Hamonog Setup ” by FlashSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.presentcapitalquick.com and multiple other hosts.
Publisher:
Piruriponi   (signed by FlashSetup (New Media Holdings Ltd))

Product:
Hamonog

Description:
Hamonog Setup

MD5:
62d39e4964268e828cc1997ccdf63c0a

SHA-1:
65fd37167c5ad484a618830254ec62495db0c2a7

SHA-256:
5c6a0a8be2e894305c041519f9cf4f7d13dbf855cde366c5acb3e2b6f0165b55

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 5:09:17 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.25.14

File size:
1007.2 KB (1,031,360 bytes)

Product version:
3.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\utorrent-win10.exe

Digital Signature
Signed by:
FlashSetup (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:01:27 PM

Valid to:
5/26/2016 8:36:50 PM

Subject:
CN=FlashSetup (New Media Holdings Ltd), O=FlashSetup (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDED645F5771D0B9771141024E9B6BFB

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0WWp+ArJI68hN70VWgUxYhJ/n3zhKkOZHAlfkV4:0vcAz+J4VUOhJfzhKkrcV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9129

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file utorrent-win10.exe has been seen being distributed by the following 10 URLs.

http://www.presentcapitalquick.com/WVl6OTRQVzFPV0dsSFRVVlhNalpQTlNVeVFsTllkR2RKYkV3bE1rSkhhWHB1UlhCUE1WSnJabmgwVGs1alZWTnRXbHBOSlRORUptTTlNMmg1UVZsNVFYVjVOVlJ5ZDNVNWJUaGhSVVJrTkdzNVpWZHBKVEpHVm5ZeU1teE5VWEJyTjFkWVNGaFJZeVV5Umpaek16Rm9RbHB3T0ZFMmFXdFlNQ1V5Um0xRGVsUTVhMFZUT1ZwS1EydFhXR1FsTWtaUFMyMXVNblV4T1hOcVdsZFJlRUpFYUZOdEpUSkdRMGxwT0ZSeFJYcGxVVGhFWVVoelJYaHpVVVV5Y1hONVRrTktNalUxYVd4NlQwRmllSGs1TTBsWVMzWldiV2gxSlRKQ01EbEJKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFhWVWIzSnlaVzUwTFhkcGJqRXdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkWFJ2Y25KbGJuUXRkMmx1Wkc5M2N6RXdMbU52YlNVeVJuVlViM0p5Wlc1MExtVjRaUT09

http://www.presentcapitalquick.com/c?x=lIJfZYIcancIYAr37pvDSmeBsigDsEEsXGA5HNAYLQ8=&c=G/BcvpnhHoYVn/SR7K37bYtrjUX6zxNOPlfc2tR1UNo3mfGUt hqVOMnop420Lcfqo9wc6RgwSUXBuzTCs8lkccI2DLWgdObhEqk/JLP fRpa/kg7IUfGT4w9kf3h2jL03aQH7Z3K6EjKasNdDEydvx0YO0w6brHQXTZuOtlvLY=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=GCl1YDYHxeDZHeFEGzUVd3kYLGGBDF/lTApgaEiROM8=&c=WJW3HI/6i63xcMdf bb4H5lUT6Iw3WkD7pfF5CGVNhJ47Z07leuTPKC13haZcKXcjwLInI0zekPQgOuaCBo c2R3lC3D1bzGikbqIn3dYUmfu/JColgTP7SAQ/gvL2j2aJ//FB1WUmb9nh2oIkOGrxizPOlIBc2yvvQhNc1wTrE=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=C6T4baRiE8V4qn6A7iQ1tCL214vFZ0ZGQqluygwwWA4=&c=MeTJ7r8Ge2b0y 7Id12mO7yY761rQWusynLNlwjgYKVYxbJ9ln4UOSDvkGaftkYtBXf2JgCe4QHyVNX5KPXDeNti5t8d URlt9K6YGJAdU/jDNsmuw/Mk63TgFkyEVVZIsIsuE72U zeGknMDhHnO9Ma30HG7xefWK3uENJHJRg=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=Pr5DAFfGiGFnxKGz5sRFkL5/LVy52hQ cf5GEMuyl g=&c=KUbybH6SbGm92ebevpBvEoroqlppJ1esesSyS7NvAsZBfGHJPdc6Uf FzanQg4T 0KqdclO6 7FrqifN6TFmcmDyr6coJw294jA37LQJCKAN34zglv6X5KH4wIFAVIN6yPByUkgRcJEzinYt65637DrdDb H1aPT3tz0sVebZzw=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=yOHur4ivTVo2IDfHiQsKPsBcDXfbw7lGPFyzpKvzUDw=&c=xhZIgcWWvxMsCb2dxp mXTOETZcpQ9B9XEkvcBRASqJqc5/zYVCNtV0czQX2XLbShzDH9 sS8VyzBveVbRfdJvSpx0dx7duxqKK46NWsuh w/KqnJ2C9RJ5I IjDcMDiQQVm/XVbzdWWTKw3TmvDcFYIHAF4JW5asghWJAevcLw=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=53QtoSxOWZsGk4xJeLqu8uF8wGEJe1KY4fCRWmXDu70=&c=geuqv9auTxVI34DllGCvmW3rVj8OUJwFVZtEroa9Ms0npt UM 5KhgUoWDlJJNYT8HZ6ZpkGRsoZBrnDyEYCnN 8fR3g1MG4M0mLuvLLpgHFFNCGb1NYTeW2/rbnhuBbrmOXJq9keqGB8pGA8LzvBUv5CC/tySa3YH3UlNQVf0c=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x=LSsUzuzL9GrbWmAzh0Z5IbiDl97vkqatAJbFmyMHjXQ=&c=YBtkW/O66avDXTK aioAMbnN3GivBfpQfaeiqPxxOixPKxnExBZWm4 VJD dyu2f1lGllsxRMQkpPHssv99 eC3v/HEUVuT6XNdmuEavIiSD5dYRQ /FGRzp2KKlo7W6px7BhtnIacC367ZUzOV2hJi/9K pmeySwNYPvJcLKOs=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/c?x= hK39CI7ypPF/kB0Ug2WTIxMr mSPsJ9oukCos1k6is=&c=igHEzTokBkzP4ZRMhuC/ s/XgzA8NkF1IZT6tDpE/4Sgpy75G1GhY9xtf8pH Qi2orKfYhLHMQIjR0x YFv/oUcego25wO4YRLhOi/VcSzwmlUtDDT/aVVH3BPfdlmyuz1oKdF3rJSGzZJpMBtNiRAXG8DXqmhdvyFS4QR7fPIY=&e=0&downloadAs=uTorrent-win10&fallback_url=http://.../uTorrent.exe

http://www.presentcapitalquick.com/WVl6OTRQVXhCYkdsTmRFVTNhelpvWVRWRVozSnNTek5qYTJ4NVYza3hKVEpHTjJaeVprOXJSa2QyZWt4ME9VaDVieVV6UkNaalBVbERSVVZvYTJZd2JYSnJUMDlzYUdSaFJFTlFNSEV5YzFoU2J6aDRXREExZFZKeGEzcFJUblo2V1RkTGFISkpObnBhWkdGWlMyY3pKVEpHV0dSWVRtZDFjbEpoT0VSRFVETTFkRkZIYVRGdmMyaG9ZemxMWW5NeVlUWlNjRVpvUWtwVlRYSmpkbXhKVXpkd01GRmtTRkpXSlRKR01rMDBjR3RsV21oYWJXVTRhRWxKVWlaa2IzZHViRzloWkVGelBYVlViM0p5Wlc1MExYZHBiakV3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZFhSdmNuSmxiblF0ZDJsdVpHOTNjekV3TG1OdmJTVXlSblZVYjNKeVpXNTBMbVY0WlE9PQ==

Remove utorrent-win10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.