home

beamng_drive.exe

Tefolimane

Morava Group

The application beamng_drive.exe, “Tefolimane Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsfilessafe.com and multiple other hosts.
Publisher:
Morava Group  (signed and verified)

Product:
Tefolimane

Description:
Tefolimane Setup

Version:
2.6.5.1

MD5:
2c0f18a3db8b42dbc45829fd5a7d5cbf

SHA-1:
1105c2e539c8d6f87794f034d27c5295b01ea12e

SHA-256:
cc01a0797a729d705bcd130984494b40814cd688675f677e974aa6f45eee69a9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 1:58:03 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.6.8.9

File size:
941.3 KB (963,928 bytes)

Product version:
5.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\beamng_drive.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 12:28:01 AM

Valid to:
3/8/2017 12:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:4PKuMrVmZ4u/Z3Yiq92KkaYFzk7qxLPOy1Q83bGBE1BiVZ8urh:4CnUZ1/zv3Fzk7qlH1QfBE1B0Zjrh

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9349

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file beamng_drive.exe has been seen being distributed by the following 4 URLs.

http://www.appsfilessafe.com/gcqEjsoyQVMK TWX4QaPS1gzelv3m5IoNNmaYQKdx RRazXUm eKiLFYI7JG6CMop9iAF98Rj_EZm6JtQPA_7WRJARKTvk3o5NksLJKmR7lmz78sjts4q1J_U8hf2PifO_FGfmWg_1zzhHB8btXlUWPD0WP242kQOH4ZPZ8 67ptvhUukcwpJraz68c8OcWupIsm3y14FSrkJXwWxKLv32Thzhxmtxmkdb2X22E67dkZKHTvnrYQeK8rnHw31EhPtgVNqWlsCQ3dG4PaoZGfrxitIpJxZakMySalnscP109L0e0B0fPFXb7Z3DMByoMFj4DYvT4_ysYO_U3JKOv4omohOJOgMm7ubx0pes1CXOZUQ44ay18ZuKbwSJwPBJNcqiTzKXYC665DJzESkBw2bqLvnQwhRx7SLswdVrtar6w_dCySW_umi0_171Qaadz3vcFLud6QwnCjeohEFKc5Y91zbC4YAf9p_2SVvAXxhpbEVZZx8wR08_q_ZAoOOrBwd vUBvYn-iwWARmFsbGJhY2sgVVJMAw==

http://www.appsfilessafe.com/OsANAO0PLoltPJxISrEJCsT5t8M0mA7F7Am L1gET2qT6BQqW2Co3Xyn1m6XP 4ew22TMBv4zBUxOtky6RPZYMu9XhXxVrG9Bc9Lvk9sgMViGykdvUF5N0QoUtARSVhucZMDnzMPjDWPo UGtF8a3jCVIlTg9TX7DNFqUgFovBA1RQwNDCokoUcbtslwcuPTeniRWyvOTbBL05QvfPIw5gTAjvCnQbtXg8v3xDQ4w12YRvIUuLYTbpZvsZ0wXmL b_tK5wCzM7I06HOQPeU7Z2NPIuq 5J6UaYxne4Z3kU8k33eKToC0K8FdsQ9knS5VH0BGiabk3pIz7wh0FSZpMThD6uhBjLelr0WAPJ80JnSuHAIecyzxOQmfQJhXY7ZhhRSTm1nYfbR8Pm3tcAhMPhevP3n2DlOBVrBy5oybQsl4lABBHuojsMHGuEipSBY7kszgGb081g0RlehJ8ewThjyMshExOdK31HL5cBxeT9IREK24PhvGRY Z7IrD7Ltc2qn3fSoI-iwWARmFsbGJhY2sgVVJMAw==

http://www.appsfilessafe.com/3oZBFt3usPUqtgURZyh1EI_FCFIlsfUD8Pze5IH6RISGUK7X_IACp1P0L_JnAMS5 XHYvfS8GBJf62SKt3e3zGYS6mnYy3XrKFSgrRHE37qkMfe9LzHNFRJ__oPZDNUO8GK3_VOLRDx2NNxk3Q3Ih09 M_xioDCsoVt2eM5gk7gOClLe_QeFUf72_pi2cVdHRi0kt7RLPNsvo5MIsMr53w6mJ63yhCkil6z3ut79X8NEYBHNVRgIE46g2dHECkGa6w0hyFxXGP5ehP36fy4_AAA5YePPVxeX3yzG21l8E4cnAcf00CBLBzx9svG2_quzKwelRRNCHBTmYjupt9REFYcvWDZSQy3XDhP1DDFQw 50t3Nt2 _XYJh_F4VbSjYQCf1IaasmAGCbFvTQeWrMJIqSD3b qzIrR6Tjd0Zecs1GI30gVJbiA1ddMms_MVACzl8XpUmKoF10DMBd2rlP9owqWHl0yPL9UUd72jLYzLi1BSK6MLHDdPEoP_v6RD0vi4JHAsAB-iwWARmFsbGJhY2sgVVJMAw==

http://www.appsfilessafe.com/uNnChiiUztGeF nsW2Ldre7oEpItc4KPrc6YAvN6hIDumEKHlWGEZ9YEOmfvpYXEffQCJrWBIKVg1vSIVkvCK35sac1J3G_VA4EL4LOgefSQW2PSIt qeaMvkdwr6T_skUSmwV_Wg3jwzu ktz2a8tVEP y672Ns_eGl3mLYXr9MR9LZFtKo83A6Un7 XUdnHdLx84jCyis4sIgOaicg VNYX9QQ YgqQOgUmj6vvxSNZcrUOfvQC7LmIj5Umf 8NaC_DdOjJARZxlSCnvwOm_An2cyDtGJWza1FLN2b3msjC6Z2X8 UzsRjGyTneAdU2rqikOsyQ0 u3sPAzPrG5X_yD3blqXtSj06KScqRTbryaBiyxP90nDjbSLi8 yWHKRTfhmL_sZMwC0utPW kp6GVw6KyFD5c0Qta3tvHF1YdycbfyqgM5wxB9dv2LIMHKlhAR5ddkBepa6TlqwpEN5pdTuyym2cgvzhCwmrOs2P5iqtNh0PPHAfjJemC84sTcoeDqKv-iwWARmFsbGJhY2sgVVJMAw==

Remove beamng_drive.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.