home

utorrent.exe

Program

Agile Install (New Media Holdings Ltd.)

The application utorrent.exe, “Program Setup ” by Agile Install (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.contentsignbulk.com and multiple other hosts.
Publisher:
Internet Installer   (signed by Agile Install (New Media Holdings Ltd.))

Product:
Program

Description:
Program Setup

Version:
3.3.3.6

MD5:
52520111da9c86bf0dbf05982f81fa7e

SHA-1:
f689facb1166e8e5cbca0fb96f397bd7d284a862

SHA-256:
6a0521c85fa54387db821b883bf064590517db8770da4423e6384eede19050dc

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/28/2024 11:59:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.17.17

File size:
988.9 KB (1,012,656 bytes)

Product version:
1.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\utorrent.exe

Digital Signature
Signed by:
Agile Install (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:08:20 AM

Valid to:
10/30/2016 8:39:05 AM

Subject:
CN=Agile Install (New Media Holdings Ltd.), O=Agile Install (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E708A02FF07CE5E25618BCF50F6A6CAE

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:PZigW/sM2VCClql7wYsckYuy/g45fLv2bGKC1RwmhAGZ/y1e:PZ1dDUClql70ckY645fboGT1Dt

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9280

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file utorrent.exe has been seen being distributed by the following 3 URLs.

http://www.contentsignbulk.com/c?x=nR3I1HM3vMmDqSLDLcdM4ZkGD2txaJFbNomOQipAQfM=&c=pDUNELl1LQI3CReT6jADL9xLs5lTZTcMzgc8qYCsS5Xw4FAisiNPohO9tusadk9X5ZTG10A6WQV2cfAgxs4DQrKzHDL E7Q4/n3VoKa4WbK3MNXI9t ktGMa/5nrExij&downloadAs=uTorrent.exe&fallback_url=http://download-new.utorrent.com/os/windows/track/stable/endpoint/.../uTorrent.exe

http://www.presenthostgift.com/c?x=vel1FD8ZCGzzRY8y7FouobkC02F8ALGnOsmkUWHxRAU=&c=ULxB5jkyuXS0zu0v9XlT rj44oPftG8Q l2cYlZY5GVhtUh8azQCvF5jRqK8PtjeUM5IrEU07cSb/3d i1IqrVfcm zV/HljfOzVJfO7KNTgdDqP6v5Tsd QDUW9gZje&downloadAs=uTorrent.exe&fallback_url=http://download-new.utorrent.com/os/windows/track/stable/endpoint/.../uTorrent.exe

http://www.bundlesvaultsdownloads.com/c?x=df0U6z5SSPs5w5wrw8N3tiKD8/sH8xP97uSvTdWB8wQ=&c=nxFLmqYf22f3roh2DKcYn2J8n94sE70Me7fVZO71sZ kbBhjTrPbSrxVsKoeJcjZ9DbB1Q0niij4o0EzdlMO3F1CzO3h ejPPqQ2 lcDlaq6bDOJgN3SsltwZkRzxYtV&downloadAs=uTorrent.exe&fallback_url=http://download-new.utorrent.com/os/windows/track/stable/endpoint/.../uTorrent.exe

Remove utorrent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.