home

winrar-x64-531.exe

Henopekaf

SuperSetup (New Media Holdings Ltd.)

The application winrar-x64-531.exe, “Henopekaf Setup ” by SuperSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
SuperSetup (New Media Holdings Ltd.)  (signed and verified)

Product:
Henopekaf

Description:
Henopekaf Setup

Version:
5.4.4.6

MD5:
c52c24e9defba1cb49ebbb8318792559

SHA-1:
f68ac9aef219637a7a2d0c18379c573b406da31b

SHA-256:
55183a3c5aaa098e0315a281e334580c04bff78c1d7f501af64d11e2bf7315fe

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 7:54:32 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH (M)
16.8.11.0

File size:
953.1 KB (976,000 bytes)

Product version:
2.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\winrar-x64-531.exe

Digital Signature
Signed by:
SuperSetup (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 6:02:13 PM

Valid to:
4/23/2017 5:32:15 PM

Subject:
CN=SuperSetup (New Media Holdings Ltd.), O=SuperSetup (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112175ABD22CA9DB2F1A665A1DFE36D01DAF

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cgi3XTuNwsTE7Ubp53XoacCJksuovm6r+Fk6xcJ4oBWYC:ctn9Jep53YMX+FnxJ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file winrar-x64-531.exe has been seen being distributed by the following URL.

http://www.vaultsapplicationbody.com/_Cobdr7Bymu5CF5QSilLbAUZ_wIrrokGi6N DLYSOLs2wVKNbDCktGIbVLJ MvWK4WTdsOX8zY7aYjDyBOgDCWg3b1HbQXyC37Eo8lAvrI1y5I_YKciSu915HfbrQkRGYAab3je8Hn2X1Mk8sKf3mpiEhyyqThKHO8gXutatsv6KnZNbtT_3DpJlNj9yDqwG5JCz_FH41ke9c0FXDmGXe9vPwDnxuGctLysoFCtPCkt1nrwdguV0zOXR1VVl2qEbGbiAxAWJO1ahZNrAz8Ku4ATEvGBMQaAWdI2y3p_AeWS alHrgFvWSyervxymC97Ooj5vIvagBqQsMz1fyRpy3JANwC4hFh3_HgEOw kGizkmbujJ1Ql_vi _TjgYjUv U8Rd_a VYReYZGIvivVn ZkUbMJ5Kka10CaRf904jNZVZTRzCOXeWlucVFK6UAeOKk1KfJxUUTKICucvodiOuEKvQX8R2w==-iwWARmFsbGJhY2sgVVJMAw==

Remove winrar-x64-531.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.