home

windows-7-ultimate-sp1-x64-by-vladios13-v.06.03-2015-rus-torrent.exe

ModuleInstall

Evgen Kugitko

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application windows-7-ultimate-sp1-x64-by-vladios13-v.06.03-2015-rus-torrent.exe by Evgen Kugitko has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the WebPick InstalleRex installer. The file has been seen being downloaded from wintorrents.ru. While running, it connects to the Internet address r1.stylezip.info on port 80 using the HTTP protocol.
Publisher:
InstallShield Corporation Software   (signed by Evgen Kugitko)

Product:
ModuleInstall

Description:
Module Install

Version:
9.1.0.210

MD5:
665f6be3828ca7cedbfd666e2ab47cfb

SHA-1:
5bf408b48637a1a2362e4de0dbc7eda3a3a684d8

SHA-256:
c5c6aabe074813aa2dbffdb0f8800f4fc4d3db0eddc0c910237575f6a0d7c94f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/29/2024 6:43:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Webpick.EvgenKugitko.Bundler (M)
15.9.4.11

File size:
700.7 KB (717,544 bytes)

Product version:
2.8.0.2

Copyright:
Copyright (c) 2008 InstallShield Software

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
WebPick InstalleRex

Common path:
C:\users\{user}\downloads\windows-7-ultimate-sp1-x64-by-vladios13-v.06.03-2015-rus-torrent.exe

Digital Signature
Signed by:
Evgen Kugitko

Authority:
Thawte, Inc.

Valid from:
9/24/2014 3:00:00 AM

Valid to:
9/25/2015 2:59:59 AM

Subject:
CN=Evgen Kugitko, OU=Individual Developer, O=No Organization Affiliation, L=Kiev, S=Kiev, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4179EA1BEC59D4CA7E66862832555480

File PE Metadata
Compilation timestamp:
10/13/2013 11:19:32 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:8pb1R7rWukLamgvxbNB/i8KgZTvZkHcZmMh1LLKzlVxSQsjzNFkNe:8phlrgLam6/Wghdh1LGzlfSQsdH

Entry address:
0x1411FE

Entry point:
54, 8D, 1D, 34, 26, 54, 00, 33, C9, 03, 0B, 0F, B6, 09, 80, E9, B8, 0F, 85, CA, 3F, 00, 00, 5C, 0F, 84, F9, FF, FF, FF, 00, 00, CD, 03, CD, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
930.5 KB (952,832 bytes)

The file windows-7-ultimate-sp1-x64-by-vladios13-v.06.03-2015-rus-torrent.exe has been seen being distributed by the following URL.

http://wintorrents.ru/.../classes/moneyinst/mi_request.php?sid=ODQ=&url=aHR0cDovL3dpbnRvcnJlbnRzLnJ1L2VuZ2luZS9kb3dubG9hZC5waHA/aWQ9MzA2OA==&name=V2luZG93cy03LVVsdGltYXRlLVNQMS14NjQtYnktVmxhZGlvczEzLXYuMDYuMDMtMjAxNS1SVVMudG9ycmVudA==&type=Ng==&href=http://wintorrents.ru/.../download.php?id=3068

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.