home

wizard101 setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application wizard101 setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.filescleartag.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
17b65ca40ef0588580eeee317edb823f

SHA-1:
e5e1b588facaa9e34f31131ef8f74a5d517df843

SHA-256:
b78c83792afd33bc634d2851127c8a13c44bbf3d4be737667469911a6108cf78

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:22:51 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.29.19

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\wizard101 setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:25:15 AM

Valid to:
9/2/2016 6:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:K5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:KdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file wizard101 setup.exe has been seen being distributed by the following 12 URLs.

http://www.filescleartag.com/c?x=DnJnyI7wMroA85Wef9u8nHieDX3VJMNtxGkk3dyZ9E8=&c=G3Sw9r1nPZVy15O/BoV6mbEYv vWgiKkJGdA6/gnfqR7MgyiQHeu/i7CI5ayxAPIHd9QMgg29O1q8jLn11fxgYPyfZ8VSf2WWTWFhtX9Jrh4MVQi2QnbQLSgRIXPL1c2iFWORwadByL3dPzTzrodRQ==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabpresentapplication.com/c?x= ykZ2D8EtCcUwLo0g4zpw GqziGD4tmhxQDHXjvtDrI=&c=r2ae16zKzLnKISZLH86SY6hmHKpLjt1JGFZd2YaO6adqECy/eYWGJRB/ErKcoUoQG4RvaHhs0Cm5mjaz7pBbtDGPABW4QX33XS23EssJS38J8ONpT45WYyzgDlhfie/KQVdfWdXyEiJru0X0yAh67w==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabpresentapplication.com/c?x=hDQejL8qb9Lfw0FKsfnyUHE2nhheU1R6xZtkWGjv2KY=&c=rMKU/hDttweVi6 46vpqbZMbDq4HgzR3/HL4yb kadxV2Yr4hdgBgcDWvc9pJnXBe1GlEuBQV YmUG08FenXuO48bYDyiboHVH CGFlVxWvQbnUM3pl2831qcGRoDSjrz1MVyfoWE9i9k6d5XMAhVw==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.universecontentvault.com/c?x=6fxyWCXkm6EZW5kt3Mv0vRb3fssc 7ePseinPX29KCQ=&c=mNq/68 gMbipIDEuDSUxLPTWqEvBKwSTHoIS3NMo0JyW/ApLs WTRIVjZ352BZnar/DkOt5l0u3aNSF9EiNW fmoY ZkQojd2g2OMy2NaFLTcaZjVjVOeAUwjydfuHAJ coBikIUbRrhnc8ttuM4FA==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.filescleartag.com/c?x=VOJ0YkIvma9Jq8mOvbguYjwB3q9aRFNqkKKk90UIGeg=&c=4YZin5V9wHJ25GDQtd5Rf6C1iBBynmZ6ryScoGHC46B2cT2e1 rw6KMjuNdpb12Y2DCsITLEzVbT/rDSsOCwmVfDq2pHxmI/2g4MU0NGfgLVt0ohNUVPwdQqIJOE9PXWulFIix5zPbmsyQlJA6SNrA==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabupdatebundles.com/c?x=Vev3vkv5QEPEn UAriWtuE992f1twkLn4lewBf9lZf0=&c=mFWQ0toPzCjaEE44meX/8uz9bWKA131IUlFmoj5yxNnZgEZOzTkzEzkmm08kUwUmFQZ8g/2606EUPBYV1c/5kV7AE2AkjjkxJvVOdvR0Id50G2yxaCBlv7lX4LJVHnTWqs9Hk nmSepdAeiNu/1b9w==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabpresentapplication.com/c?x=2LyEvqtBc1AAQuHv0yEfyhiLDAZk3gmJLD6PgIv/0Js=&c=H/kiJHT0jWjTSJHGJRa IfJUkyspVxldPLVwcjG TGuuRnD0g4h MGokoeZHWEBNNsRYrOYUZHm2VCj75vjvv/qMBZq k1UVQqiJvHfWYQBrguWkI0XipgTfdA07pv MTB7mRLjICtemVheJSRzkSw==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.currentbundlescontent.com/c?x=uvaaGuRyFg6duYQZijyUuAelJgrKYFC2WulMnpOvgjE=&c=GxIRIoBXhP1R5m5wZOQrkIz62t/LoExBgFvJ50WB3LtJzn6pyLJl3folLGQBQ lR5wym G1DYlgmdIJ/bqh8JvHe3HY1iQ4Xgz7uGljTvfR4VztR2Gg1K1TSA6/eZ3C0tmgZyHv9Vqyi2FBB4B7zLA==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.centertowernow.com/c?x=kp5cvM0ztu0yWWTFY6u4v3VwJ91ZzND JKRpcVoH/MI=&c=xpJurgzBk1ZyAcZFdbyCeNPPjmSDUQUELx/XtNjh55BZUgTjLOEB dSiL0ky3jFbBTT0Jfi3Knj5dI0OcgChxzoeduTQ3LiChbkT4635rnqSceQWzTwCls//0ANeu2ns642SWwBCB7lbYBtJZ8CDnw==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabpresentapplication.com/c?x=TGLrfSSeatU9ypaxVkFuSIJuVCNR9iF8C xc2Ji7918=&c=7SOgSns1iG7PKeSRaYoCpEBj4amR3795JnbkZeY 4tXJ0rAoTtTfWipJnQYsaLVVnZvCJXUlRVuhuXtPgwXVa/V bnXB8YG03DnWfeYQNVkMllVCmMy/EFewOPExsDYo2ZHRX0qNoPmjOurdbht5 w==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.chuckledownloadstag.com/c?x=Qzs5GbG7KB6HLASWwHEMQnbnptbjfWEGtjVquMRH2og=&c=ENcfNO8VbO D0som1UkBbW5RXtC98ZK8aTtcmjwyithVEjMzHDlYuaJSPRs9pj4wA/408G OABUL1zjpxy1XxmfahxoALOnXKO7wMDanXldsm1TKOVAE7XY4POvq9YnKdh78/BNgvGqPFJCdniOOpg==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

http://www.grabupdatebundles.com/c?x=ubf44EOWT3n1Vl72JmArI1ek3Y5TZBXH6WW7j3Dbfwg=&c=unRLffFQ0RDWhqHrGcsDP4EWGVvA8Uy5RUX0DktfkzxTGt3cnDiOj2yCGiUvtkZ8BCcr02K/n8umo2WhYJ7APyOwqLhkoJuFLpUGVYAm3sEidOx60OA3N8a8IpRKxx6tWSC25Qa7WaushrrQHZgVBQ==&downloadAs=Wizard101 Setup.exe&fallback_url=http://cdn.downtoad.com/.../wizard101.exe

Remove wizard101 setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.