home

00000000.111878.gzquar

Payments Interactive S.L.

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file 00000000.111878.gzquar by Payments Interactive S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the TUGUU DomaIQ Setup installer.
Publisher:
Payments Interactive S.L.  (signed and verified)

MD5:
84595814ce778e5050928a11d540a0d0

SHA-1:
b7984c011be9dfb118770745d9e4e053322d76b4

SHA-256:
0492df6f4178c235761acc18140e3904ed75879b5bf0197666e7a5c5e75a5826

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 4:45:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Tuguu (M)
17.3.6.20

File size:
387 KB (396,304 bytes)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\appdata\local\google\chrome\user data\default\file system\001\t\00\00000000.111878.gzquar

Digital Signature
Signed by:
Payments Interactive S.L.

Authority:
GlobalSign nv-sa

Valid from:
2/10/2014 11:19:40 AM

Valid to:
2/11/2015 11:19:40 AM

Subject:
E=victor.camacho@paymentsint.com, CN=Payments Interactive S.L., O=Payments Interactive S.L., L=Puntagorda, S=Tenerife, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112101CC52CD8725B37EE06251B5DC695BD9

File PE Metadata
Compilation timestamp:
3/19/2014 10:59:27 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

Entry address:
0x3056

Entry point:
E8, 57, 2A, 00, 00, E9, 7F, FE, FF, FF, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41, FE, 8B, 4C, 24, 04, 2B, C1...
 
[+]

Code size:
37 KB (37,888 bytes)

Remove 00000000.111878.gzquar - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.