» christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe
Overview
Analysis
File Details
Downloads (1)

christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe

CORLEON GROUP LTD

The application christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe by CORLEON GROUP has been detected as adware by 22 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from kapq5300u940dif.battletrek.ru.

File name:

Publisher:

CORLEON GROUP LTD (signed and verified)

Version:

1.0.0.0

MD5:

74d1440ed9a1ca507fbefa5c23d17b26

SHA-1:

92ee751fa95d9bf1998c2b963c9f97ed1b4f8f2a

SHA-256:

802dc1ddcc3131d77071ec200e6a2fea2f414cd932a313011a215c3596f7bab5

Scanner detections:

22 / 68

Status:

Adware

Analysis date:

11/1/2024 1:42:19 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.InstallMonster.F

906

Agnitum Outpost

Trojan.InstallMonster

7.1.1

Avira AntiVirus

TR/Fraud.Gen7

7.11.166.244

avast!

Win32:InstallMonstr-DY [PUP]

2014.9-140812

Bitdefender

Application.InstallMonster.F

1.0.20.1120

Dr.Web

Trojan.InstallMonster.242

9.0.1.0224

Emsisoft Anti-Malware

Application.InstallMonster

8.14.08.15.12

ESET NOD32

Win32/InstallMonstr.FE potentially unwanted application

8.7.0.302.0

F-Prot

W32/A-114b89a9

v6.4.7.1.166

F-Secure

Application.InstallMonster.F

11.2014-12-08_3

G Data

Application.InstallMonster

14.8.24

herdProtect (fuzzy)

variant of kid_cudi_muzyka_dlya_silovoj_trenirovki_muzyka_dlya_trenirovok_workout_music_muzyka_dlya_trenirovok_ (Adware)

2014.10.22.7

IKARUS anti.virus

PUA.InstMonster

t3scan.1.7.5.0

K7 AntiVirus

Unwanted-Program

13.183.13043

McAfee

Trojan.Artemis!6CE08F703E9E

5600.6970

MicroWorld eScan

Application.InstallMonster.F

15.0.0.672

NANO AntiVirus

Trojan.Win32.InstallMonster.dbipfy

0.28.2.61519

Panda Antivirus

PUP/InstallMonstr

14.08.12.04

Reason Heuristics

PUP.CORLEONGROUP.?

14.8.12.13

Sophos

Install Monster

4.98

Vba32 AntiVirus

Signed-Downware.InstallMonstr

3.12.26.3

VIPRE Antivirus

Threat.4845009

32186

File size:

3.5 MB (3,664,568 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Documents and Settings\{user}\My documents\downloads\christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe

Digital Signature

Signed by:

CORLEON GROUP LTD

Authority:

VeriSign, Inc.

Valid from:

1/16/2014 2:00:00 AM

Valid to:

1/17/2015 1:59:59 AM

Subject:

CN=CORLEON GROUP LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=CORLEON GROUP LTD, L=Mahe, S=Maine, C=SC

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

05D1EDA621A201F36C3E158FEB2D4DC2

File PE Metadata

Compilation timestamp:

8/1/2014 5:12:00 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:/xvbnwXHzVur7yD6bALzG9a1L4l7rWuC9PF8cWaF:i3zHWcu9a1L4lvWu0OyF

Entry address:

0x974500

Entry point:

60, BE, 00, 60, A7, 00, 8D, BE, 00, B0, 98, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA

Code size:

3 MB (3,141,632 bytes)

The file christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe has been seen being distributed by the following URL.

http://kapq5300u940dif.battletrek.ru/get_file/?sid=23&url=http://stream.get-tune.net/listen/142174263/-18921089/1294383404/.../Christina_Perri_._A_Thousand_Years_-_MINUS_Bek_original_club18921089_(get-tune.net).mp3&name=Christina_Perri_._A_Thousand_Years_-_MINUS_Bek_original_club18921089_(get-tune.net).mp3&type=mp3&size=5992349

Remove christina_perri_._a_thousand_years_-_minus_bek_original_club18921089_(get-tune.net).exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.