» winrar-x64-420_installer.exe
Overview
Analysis
File Details

winrar-x64-420_installer.exe

winrar-x64-420_installer

WebSys, s.r.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar-x64-420_installer.exe, “winrar-x64-420_installer Setup” by WebSys, s.r.o has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download WinRAR archiver but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

windows7download.com (signed by WebSys, s.r.o.)

Product:

winrar-x64-420_installer

Description:

winrar-x64-420_installer Setup

Version:

1,18,0,2810

MD5:

31e0279f1fd1888ff0cec54fcf240138

SHA-1:

573899cd2af1bcbcdff5e5c7b1b1bf943fa05a9c

SHA-256:

299d12519f66a6bf0cbe4fe9fb42bd1d624c362e1bdc5dde35291a327582f11f

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore monetization platform to install additional offers that might include adware.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/28/2024 2:40:26 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore (M)

17.2.12.18

File size:

361.6 KB (370,296 bytes)

Product version:

1,18,0,2810

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore

Common path:

C:\users\{user}\downloads\winrar-x64-420_installer.exe

Digital Signature

Signed by:

WebSys, s.r.o.

Authority:

COMODO CA Limited

Valid from:

3/21/2013 1:00:00 AM

Valid to:

3/22/2015 12:59:59 AM

Subject:

CN="WebSys, s.r.o.", O="WebSys, s.r.o.", STREET=Namestie sv. Martina 9, L=Holíč, S=SK, PostalCode=908 51, C=SK

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00DD73B25D7DEDED24BD3E70AEEA691C96

File PE Metadata

Compilation timestamp:

8/14/2012 3:05:18 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

7.10

Entry address:

0x1000

Entry point:

55, 8B, EC, 81, EC, 18, 04, 00, 00, 53, 56, 57, BE, A4, 30, 40, 00, 8D, BD, E8, FB, FF, FF, A5, A5, A5, 6A, 7E, 66, A5, 59, 33, C0, 8D, BD, F6, FB, FF, FF, F3, AB, 66, AB, BB, 04, 01, 00, 00, 53, 8D, 85, E8, FB, FF, FF, 50, FF, 15, 5C, 30, 40, 00, 66, 83, A5, F0, FD, FF, FF, 00, 33, C0, B9, 81, 00, 00, 00, 8D, BD, F2, FD, FF, FF, F3, AB, 66, AB, 8D, 85, F0, FD, FF, FF, 50, 8D, 85, E8, FB, FF, FF, 50, C7, 45, F8, FD, FF, FF, FF, E8, 0F, 01, 00, 00, 84, C0, 59, 59, 74, 15, 8D, 75, F8, 8D, BD, F0, FD, FF, FF... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

Remove winrar-x64-420_installer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.