GridinSoft Threat Intelligence

pidgin_installer_1930.exe threat report

Detected as Adware.InstallIQ File reputation report
MD5 46e348e1d92644d25a16323c5851284d
Latest seen 2021-01-09 08:19:44 (5 years ago)
First seen 2020-12-20 05:53:23 (5 years ago)
Size 1 MB
Publisher W3i, LLC
Product InstallIQ Installation Utility
Signed by W3i, LLC

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Adware.InstallIQ. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Adware.InstallIQ
Recommended action
Scan and remove
Last analysis
2021-01-09 08:19:44 (5 years ago)
File hash
46e348e1d92644d25a16323c5851284d
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Adware.InstallIQ.

Timeline

First seen 2020-12-20 05:53:23 (5 years ago); latest analysis 2021-01-09 08:19:44 (5 years ago).

Publisher context

Company metadata: W3i, LLC. Product metadata: InstallIQ Installation Utility.

Digital signature

Signed by W3i, LLC. The signature is reported as valid, but signed files can still be bundled or abused.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

File context

pidgin_installer_1930.exe is a Windows file recorded in the ThreatInfo database. It is associated with InstallIQ Installation Utility. The reported company name is W3i, LLC. The current detection status is Adware.InstallIQ, based on the latest analysis from 2021-01-09 08:19:44 (5 years ago).

If pidgin_installer_1930.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Adware.InstallIQ.

File Details

Product Name: InstallIQ Installation Utility
Company Name: W3i, LLC
MD5: 46e348e1d92644d25a16323c5851284d
Size: 1 MB
First Published: 2020-12-20 05:53:23 (5 years ago)
Latest Published: 2021-01-09 08:19:44 (5 years ago)
Status: Adware.InstallIQ (on last analysis)
Analysis Date: 2021-01-09 08:19:44 (5 years ago)

Detection screenshot

pidgin_installer_1930.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Overview

Signed By: W3i, LLC
Status: Valid

The signature on pidgin_installer_1930.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

Common Places:

%sysdrive%\i drive\james software\windows 8\new folder\zrenubala software

ThreatInfo has observed pidgin_installer_1930.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen pidgin_installer_1930.exe across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country India
Share 100.0%
Low High activity

The strongest geographic signal for this file is India with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows Vista 50.0%
Windows 7 50.0%

The most common operating system signal for pidgin_installer_1930.exe is Windows Vista with 50.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

pidgin_installer_1930.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x00041b54
Image base 0x00400000

PE Sections:

Sections 30
Raw data 1542144

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 370688 bytes · 24.0% of section data
MD5 a714cf39df2dc9fe686ec303df519d66
.text-co 16384 bytes · 1.1% of section data
Uncommon name
MD5 284d9626163233c184dc49c5abc89888
.text-co 100864 bytes · 6.5% of section data
Uncommon name
MD5 782f7ba87a8ec9ea772becfa31fdd30c
.text-co 37376 bytes · 2.4% of section data
Uncommon name
MD5 20c622baee95e81ecbd28aaefb007079
.text-co 57344 bytes · 3.7% of section data
Uncommon name
MD5 809da6671f6d113e5f94c88e935af7ce
.text-co 11264 bytes · 0.7% of section data
Uncommon name
MD5 542ee065432b320c9b07a88136d43d25
.text-co 19968 bytes · 1.3% of section data
Uncommon name
MD5 81228b576af1d01b2c61e86a19708b86
.text-co 13824 bytes · 0.9% of section data
Uncommon name
MD5 9d3e2e4cf02688192db7f35da8553e38
.text-co 60928 bytes · 4.0% of section data
Uncommon name
MD5 1975d17ba73e9d148b73379feae48ffd
.text-fr 11264 bytes · 0.7% of section data
Uncommon name
MD5 2da8631b7f0b21914c333bc2b1411913
.text-co 70144 bytes · 4.5% of section data
Uncommon name
MD5 e9ee11d55925365cd0224e5773c95244
.text-co 71168 bytes · 4.6% of section data
Uncommon name
MD5 b69b74ce2795ef79097e6d59e587e483
.text-co 12288 bytes · 0.8% of section data
Uncommon name
MD5 5d1d409518302e9d1c2348a6f08c2523
.text-co 10752 bytes · 0.7% of section data
Uncommon name
MD5 8b62980b077ac2329a710784cd7f1deb
.text-co 26112 bytes · 1.7% of section data
Uncommon name
MD5 f6f2cf32b94fb2262da8373e96f40ba7
.text-ti 41984 bytes · 2.7% of section data
Uncommon name
MD5 a677452597101aab6db4f3e2cff56719
.text-co 9728 bytes · 0.6% of section data
Uncommon name
MD5 b242c99afecc70abe09014a0bae27fa5
.text-de 88064 bytes · 5.7% of section data
Uncommon name
MD5 29c1207d1789058066d94ad681c81921
.rdata 268800 bytes · 17.4% of section data
MD5 3b59229ea1b2f7b818c9995485dfb568
.data 16896 bytes · 1.1% of section data
MD5 b06c919aead25e076becbcd89a9a90df
.data-de 512 bytes · 0.0% of section data
Uncommon name
MD5 9475a59226943a3ad422e18169989f66
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 bf619eac0cdf3f68d496ea9344137e8b
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 3c103668c6561965513bc80b7ec40706
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 a91e89437fbde4f92937ca0d78ba3321
.data-ti 1536 bytes · 0.1% of section data
Uncommon name
MD5 b9cdfbe433a77634056a9360bd4c974e
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 0eb973a4ccfe2984edd1634355e87204
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 9475a59226943a3ad422e18169989f66
.data-fr 512 bytes · 0.0% of section data
Uncommon name
MD5 bf619eac0cdf3f68d496ea9344137e8b
.data-co 512 bytes · 0.0% of section data
Uncommon name
MD5 b18abd9e1dfda41feab6e381eb92ae28
.rsrc 220672 bytes · 14.3% of section data
MD5 728d5f22b56561209a4e30d3be5f93ea

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Adware.InstallIQ

This report identifies pidgin_installer_1930.exe by MD5 46e348e1d92644d25a16323c5851284d. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 46e348e1d92644d25a16323c5851284d.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found.