home

[verified hack setup v1.32.6.exe

Theta Installer

LiveSoftAction SRL

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application [verified hack setup v1.32.6.exe by LiveSoftAction SRL has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. The file has been seen being downloaded from www.mobverify.com.
Publisher:
LiveSoft Action  (signed by LiveSoftAction SRL)

Product:
Theta Installer

Version:
9.23.3.1

MD5:
87d2b20f2f29633e48b9c3f549119adb

SHA-1:
ab55de447b0c080b1edd5872c1f64496f33f8eb8

SHA-256:
acb8d147c6244a2fc4a7579b4c15526e57d63f538be97f649ad7957b346d1599

Scanner detections:
14 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/15/2024 5:19:47 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Iminent
7.1.1

AVG
GetNow
2016.0.3032

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.1264002
0.98/21511

Comodo Security
Application.Win32.GetNow.DI
22386

Dr.Web
Adware.Iminent.25
9.0.1.0211

ESET NOD32
Win32/GetNow.I potentially unwanted application
9.7.0.302.0

herdProtect (fuzzy)
variant of bmw r1150r user guide provided through pdfretriever.com.exe (Adware)
2015.9.3.20

K7 AntiVirus
Adware
13.204.16176

Malwarebytes
PUP.Optional.LiveSoft
v2015.07.30.06

Panda Antivirus
PUP/Multitoolbar
15.07.30.06

Reason Heuristics
PUP.Sien.LiveSoftActionSRL.Bundler (M)
15.7.30.18

Sophos
PUA 'Live Soft Action' (of type Adware)
5.15

VIPRE Antivirus
Threat.4924203
40828

File size:
1.2 MB (1,244,752 bytes)

Product version:
9.23.3.1

Copyright:
(c) Live Soft Action. All rights reserved.

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SIEN SuperInstall

Language:
English (United States)

Common path:
C:\users\{user}\downloads\[verified hack setup v1.32.6.exe

Digital Signature
Signed by:
LiveSoftAction SRL

Authority:
GlobalSign nv-sa

Valid from:
3/3/2015 9:24:08 AM

Valid to:
3/3/2016 9:24:08 AM

Subject:
CN=LiveSoftAction SRL, O=LiveSoftAction SRL, L=Bucuresti, C=RO

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112115C730891244FB88071FE814148E0E53

File PE Metadata
Compilation timestamp:
6/3/2015 7:57:09 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:20ff/Atv+i1kU9tEG8B4nZDr4x59YUtETgvk2c+fFF78f2yirk:hAtv/fyGDnl8z9YUWwBhr89

Entry address:
0x2F86F0

Entry point:
60, BE, 00, 10, 5E, 00, 8D, BE, 00, 00, E2, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.9110

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
1.1 MB (1,146,880 bytes)

The file [verified hack setup v1.32.6.exe has been seen being distributed by the following URL.

http://www.mobverify.com/lockers/1/.../1Vm3ooEp6iAA==&aff_sub4=&aff_sub5=

Remove [verified hack setup v1.32.6.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.