{blocked}.exe

VASSANA KONGSOONGNERN

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application {blocked}.exe by VASSANA KONGSOONGNERN has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from torntv-tv.info and multiple other hosts.
Publisher:
VASSANA KONGSOONGNERN  (signed and verified)

MD5:
a877a2b9550349d1b64f78204f0f4812

SHA-1:
e5931b09af3b46d997d6a7d42becd721b7cae6b9

SHA-256:
ea00cf4cc03408c5c86b72f6be8591506d5a81fab5a5739d3cfdb15f9f5b178b

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/24/2024 8:34:06 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen
7.11.195.162

AVG
Generic
2015.0.3260

Dr.Web
Adware.Downware.8319
9.0.1.0349

ESET NOD32
Win32/Adware.1ClickDownload.AJ
8.10878

K7 AntiVirus
Adware
13.187.14332

Kaspersky
not-a-virus:AdWare.NSIS.Yontoo
14.0.0.2794

McAfee
Artemis!ECC5C14DFA49
5600.6916

NANO AntiVirus
Trojan.Nsis.Yotoon.deckrr
0.28.6.63850

Reason Heuristics
PUP.VASSANAKONGSOONGNERN.DD
14.12.16.10

Sophos
CoolMirage
4.98

Trend Micro House Call
Suspicious_GEN.F47V1214
7.2.349

VIPRE Antivirus
CoolMirage Ltd
35736

File size:
467.1 KB (478,264 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\the_little_book_of_pussy_full.exe

Digital Signature
Authority:
Thawte, Inc.

Valid from:
10/6/2014 2:00:00 AM

Valid to:
10/7/2015 1:59:59 AM

Subject:
CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:s2vCX26Rx5bAwl2JuhZK2GrthvZsbo9VdTviEdsSpGF:VKXNR0K2MhZyhhsb6VxvDdsSpo

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file {blocked}.exe has been seen being distributed by the following 32 URLs.

http://torntv-tv.info/common/custom/unibomber2_mejor.php?pub=mejor&file=uggc://jjj.zrwberaib.pbz/hcybnqf/.../&name=Sbe Jubz gur Oryy Gbyyf&fall=1

Latest 30 of 32 download URLs

Remove {blocked}.exe - Powered by Reason Core Security