home

wifihotspotcreatorsetup.exe

The application wifihotspotcreatorsetup.exe has been detected as a potentially unwanted program by 21 anti-malware scanners. The file has been seen being downloaded from cdn.wifihotspotcreator.com a known adware distribution point operated by W3i, LLC.
MD5:
b13321fc40a1b31afd039a2528cbb759

SHA-1:
d839f5944700a90cdee169cff45d46466f6f600a

SHA-256:
4aaef5d16eaecb1c2068c1d7488c45cab630bd3b257ed40c570646e96462fabc

Scanner detections:
21 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallIQ (by InstallX) software bundler that may include toolbars and other browser extensions offers.

Analysis date:
11/22/2024 11:33:35 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Installiq
2014.01.09

Avira AntiVirus
TR/Agent.1611042
7.11.124.148

avast!
Win32:Adware-gen [Adw]
2014.9-140813

AVG
MultiBundle
2015.0.3384

Bkav FE
W32.Clod2e3.Trojan
1.3.0.4959

Comodo Security
Application.Win32.InstallIQ.B
17588

Dr.Web
Adware.Downware.2512
9.0.1.0225

ESET NOD32
Win32/InstallIQ (variant)
8.9971

herdProtect (fuzzy)
variant of pdf_14315_2210.exe (Adware)
2014.10.25.0

IKARUS anti.virus
Virus.Win32.Heur
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.InstallIQ
v2014.08.13.08

McAfee
Artemis!DB2CD4FB5A6A
5600.7040

NANO AntiVirus
Riskware.Win32.Searcher.cjaztx
0.28.0.57029

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
Threat.Win.Reputation.IMP
14.8.13.8

Rising Antivirus
PE:PUF.InstallIQ!1.9E4F
23.00.65.14811

Total Defense
Win32/Tnega.eKHcQJB
37.0.10498

Trend Micro House Call
TROJ_GEN.F47V1126
7.2.225

VIPRE Antivirus
InstallIQ Installer
30470

XVirus List
Win.Detected
2.3.31

File size:
1.5 MB (1,599,025 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
10/16/2013 5:00:56 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:GmJZoU7YgH4A2UBmRtgB5LK5YZhO24A7Tw6rnhDAJZDt3MO1xVTehWTI1gcKGx3e:xYTOYgekj7trhMJZX1x4WTUuz8Id

Entry address:
0x4703D

Entry point:
E8, F0, 3A, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C8, 32, 51, 00, E8, 2D, 2B, 00, 00, E8, BD, 3C, 00, 00, 0F, B7, F0, 6A, 02, E8, 83, 3A, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 64, 34, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.9645

Code size:
913.5 KB (935,424 bytes)

The file wifihotspotcreatorsetup.exe has been seen being distributed by the following URL.

http://cdn.wifihotspotcreator.com/WiFiHotSpotCreatorSetup.exe

Remove wifihotspotcreatorsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.