home

whitesmokeinstaller__1464_i144723943_il1877588.exe

Installer

WhiteSmoke Inc

The application whitesmokeinstaller__1464_i144723943_il1877588.exe by WhiteSmoke Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Amonetize ltd.  (signed by WhiteSmoke Inc)

Product:
Installer

Version:
1.1.2.53

MD5:
2d6d31bd4fac2bcc5a5b2edc64a48973

SHA-1:
2c103bb810cc48eea1b37ffc9a0e9e2ac0b88f56

SHA-256:
b397dc92aa22551a8616ebd1935dbed4f8ccee7c79472105d11732fd8d93ecd0

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/24/2024 1:41:09 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WhiteSmoke (M)
16.11.5.11

File size:
154.3 KB (158,048 bytes)

Product version:
1.1.2.53

Copyright:
(c) Amonetize ltd., 2012,2013. All rights reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\whitesmokeinstaller__1464_i144723943_il1877588.exe

Digital Signature
Signed by:
WhiteSmoke Inc

Authority:
VeriSign, Inc.

Valid from:
6/28/2011 8:00:00 PM

Valid to:
7/7/2013 7:59:59 PM

Subject:
CN=WhiteSmoke Inc, OU=R&D, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=WhiteSmoke Inc, L=New York, S=New York, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
64048D72F9FFEF12A43FC4F4CEA580E3

File PE Metadata
Compilation timestamp:
5/23/2013 10:23:58 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:ZCckSefp+/KalxN1ZOSRn6Q+6quXe/oWFm3kebn48zASqdbx3zBxoD:ZHkSexYrNDBEQ+6qnNeD4zSaxtOD

Entry address:
0x5FCD0

Entry point:
60, BE, 00, F0, 43, 00, 8D, BE, 00, 20, FC, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.7958

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
132 KB (135,168 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.