home

bearsharev10.exe

CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti

The application bearsharev10.exe by CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Sti has been detected as adware by 3 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from www.tamindir.com and multiple other hosts.
Publisher:
CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti  (signed and verified)

Version:
1, 1, 0, 0

MD5:
d57d4473ca6e9a49db8f268032a7c4af

SHA-1:
a1ab812edda012dc87d8a1bcab7dab4a4598ca26

SHA-256:
6b7a76d063d100cf76cc5dd0e17d0f2b03f55ac3b7ee016572af1d8272fc0244

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
11/23/2024 10:15:01 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod7f7.Trojan
1.3.0.4613

herdProtect (fuzzy)
variant of start-menu-8.exe (Adware)
2014.4.5.16

Reason Heuristics
PUP.CNTBilisimTeknolojisipazrekturltlhTicSti.M
14.8.8.0

File size:
537.3 KB (550,240 bytes)

File type:
Executable application (Win32 EXE)

Language:
Ingilizce (Birlesik Krallik)

Common path:
C:\users\{user}\downloads\bearsharev10.exe

Digital Signature
Signed by:
CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti

Authority:
COMODO CA Limited

Valid from:
2/2/2012 2:00:00 AM

Valid to:
2/2/2014 1:59:59 AM

Subject:
CN=CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti, OU=CNT Bilisim Teknolojisi Tic Ltd Sti, O=CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti, STREET=273/1 Sk. Mansuroglu Mah. Narlibahce Sit., STREET=No:6 B1 Blok Daire:2, STREET=Bayrakli, L=Caner Bayraktar, S=Izmir, PostalCode=35030, C=TR

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2491AD8A2DE204BEAB2DC62493BE62FA

File PE Metadata
Compilation timestamp:
1/29/2012 11:32:28 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:F6Wq4aaE6KwyF5L0Y2D1PqLNc8x2HcezkMkBgKcRjZ5:TthEVaPqLNc22Hbzk7BgKcVT

Entry address:
0xB2E80

Entry point:
60, BE, 00, 10, 47, 00, 8D, BE, 00, 00, F9, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
268 KB (274,432 bytes)

The file bearsharev10.exe has been seen being distributed by the following 5 URLs.

http://www.tamindir.com/indir/MjAxMy0xMC0xNSAxOTo0OTowMg==/bearshare/.../11.0.0.133554

http://www.tamindir.com/indir/MjAxMy0xMS0xMiAyMToyMzoyNQ==/bearshare/.../11.0.0.133554

http://www.tamindir.com/indir/MjAxMy0xMC0wNCAyMTo0NzozMw==/bearshare/.../11.0.0.133554

http://depo.indir.so/.../BearshareV10.exe

http://tamindir.com/indir/MjAxMy0wNS0yNiAwMToxMzowMg==/bearshare/.../10

Remove bearsharev10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.