home

virtual_mix_pro.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application virtual_mix_pro.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsworlddelivery.com and multiple other hosts.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
1c170f6e07dc1857c70f836837a6ad52

SHA-1:
6a46cb7ad8cc0c44dea41b9ddbdcbe55ef5c0e70

SHA-256:
4696d3b9bc384ea1872c0789f0ebde6b55388087eb9f5d4645c7658f39b31587

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/28/2024 4:36:18 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.13.7

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\virtual_mix_pro.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 8:14:15 AM

Valid to:
8/4/2016 10:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:7pZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9246

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file virtual_mix_pro.exe has been seen being distributed by the following 4 URLs.

http://www.appsworlddelivery.com/ffVRCtsRwZkv3t_QzdC8VDKsnxZ1xW_ak_QNQrvORhJyjpvXTUamStFZGLI5i yGrbRUkFHSn_5xLHQ48D981DEal2RoXqIzhQExuGp2ZfmCSMIX3NKKkjgx1chmKnBj8PAfSVawm0rXIL3KPNkFPz5y67_Bva8Tg4FTMGJfyzKjwhdbxzit9gL96JpLc0lT0kU8TSU -GzIAAERPFhvlsd4m2A0BOOSAD6htJQkHJDW2eSDfWAEFVgixmOJ8Dqfye2R8Ag==

http://www.appsworlddelivery.com/E56IGMKP7jgj1VAzUTbddoleuqVWQPQf0rjsPRkREhvqqLvYe09nefQit301Tx9OhdGxOXR u9Cs1WWRxDV60g_0GFPD7jgXQmLJPVMrTOQo534GDfQqm0Fq TJ EhuUYQRWG69BYopjRMqtSRXGD9KOtEkPoi6PSLNza35vt9tzwENi1D6OLuiBjWauQrJhqtvGjTQz-GzIAAERPFhvlsd4m2A0BOOSAD6htJQkHJDW2eSDfWAEFVgixmOJ8Dqfye2R8Ag==

http://www.appsworlddelivery.com/yRdLg9tF61HDlsKomhrRP3JuftLPdWtq245R9XLq1qh hydwdgeNWgtS zzAdSeLW_S7hPePAXFaAocdDJhH3s8_np0LYVZ_qlN0njSKo2t82bUXc0GSh hXggWHaTQ_91Rfhb3JMEnPBA9XzGwQe1C5v2oeXcknMMmJKP_sNNlVBmrUwN2K8o63BuWbA1i5lVOeEUeU-GzIAAERPFhvlsd4m2A0BOOSAD6htJQkHJDW2eSDfWAEFVgixmOJ8Dqfye2R8Ag==

http://www.appsworlddelivery.com/VjMVIn4ARfEoQ44iyF8gn 61V4WHNifpotEvtB03bsqWG OMVxrKNGv201ZlrUbWiabUd nf3NmmYlOguu DrFD8c 4YE95h3SP1rvfF2LfhdrnlafLkd2ohp9E2aNNX9UkluFqXg5zjmZQa1ogloQ9HbJzkZfO2CDsXxsY13IiHiipAZ4TYJuBtFRkKGIp2rmZCZBi3-GzIAAERPFhvlsd4m2A0BOOSAD6htJQkHJDW2eSDfWAEFVgixmOJ8Dqfye2R8Ag==

Remove virtual_mix_pro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.