home

yahoo messenger setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application yahoo messenger setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaultsfilespackage.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
787c3b2ac2edfe81c7007a757ab4e2f2

SHA-1:
98d0e104fe7d1f6bd42405199864c41600ff1b47

SHA-256:
70fd7e4bb175baf8ebad9db16378ddaa38933c414132b5d75fa69f248786d9dc

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:24:20 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.31.22

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\yahoo messenger setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:25:15 AM

Valid to:
9/2/2016 3:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:i5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:idlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file yahoo messenger setup.exe has been seen being distributed by the following 6 URLs.

http://www.vaultsfilespackage.com/c?x=Lh9RWI84EDP1Az4 6YbZw8VX8J/BNvoKPhZJttSA2V8=&c=sp0bx98p0DhHRHzH0lbwFhZHxYwJeSyhvC2iounbNBm/CjwRrA04KB3 ICpWm2Qo9aET45zJmuMVKn4PaLzvNja9zwFKXkofJPZ85X4 8AB0e8xem8 nhM dfpK5jraPEb9b8SbXcwXNOGa/eY0euA==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.universecontentvault.com/c?x=LcPEJUMaB hnqIj1UuQd1 8sdXkqw3EpgxNlM4thoY=&c=rzzxIQMjaxJEBj62EzIrktTim10TOhHsaT6T2gGNLByY5inAXd9GNj2 /WDTePgu84/eeP0le5xBd6W7kyb/w xna4citPKnTv7k v27rTXWRrbFihPKm4M4J9Z Lb9tQvcoV5q1ORK5fvTQ8qIUWA==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.currentbundlescontent.com/c?x=odA C6Ci68/DVjvgwtb8C0WyMYF8ALOd3 qgGGBkd9A=&c=R32V6BbYngAk cV6GH6TFcFekntBZ4HZ7/yqY1toGi3GQzrM/3kDF rsgP5U3CEzjRHDgeqjle9Axr 0dTbttUtzMgYYtOtSeC3jz9A9NSd19hJ/C4QTrkgZIaam4me6irIllbjDtcgAeu4xuhOXqQ==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.currentbundlescontent.com/c?x=N0ZKxBnUO430Bs67g52m2Y56bSNbYc30HS13q80I9qo=&c=giEsm9lL8sYk 2NKXD7zPx8yDl 3Cm8Tni0iZdUvdP59fpLtib8wWRxhuCwIs0PafKbaHz6otcs8Mkoz21tGEilGu3rv ir2O207R0SDCJl/nIkMroV10Dd7lQUZfliqpTbv0kRq/lNPR4DBOqJasw==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.centertowernow.com/c?x=eTh/KInWtbf 4y3tyEB58sGgEjmvCCd0CMh0 QCjD o=&c=nj5tUNPgRzuoQEBS61fXs1zQqS/g2W7Bl3S/YHkj4gPc06U62tLIRd2D0vir 923VUVoS2yiCM2M9JU0alZ2cQ/ySdeJMo4XfNuxvUSI6lOQnPhD1pZ131xXljaGSk1emvXXfryEwlztqa15v7P7Jg==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=yMOWV/5PWMIwvD1nreTwbsCyNLXC mHQ5Q9pSjEF8wU=&c=z JEgQkKo4QlT6aGbI44zy34fAZZYTPOyAEUosBrVqzuHIoEq8J2/hrNw 3T2bEqP2UpLJRGs9CS6yk/77lBbR yFM5dW7EtEQaKWAd9j/1tWBGQULUNLvMTZD2HgqB0YLLjLdkhQKVzdYXVXoBxXA==&downloadAs=Yahoo Messenger Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove yahoo messenger setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.