home

cool-torrent.net_barbaruans.rising.2016.s01e01-03.hdtvrip-torrent.exe

Proxomitron

Amulet

The application cool-torrent.net_barbaruans.rising.2016.s01e01-03.hdtvrip-torrent.exe, “The Installer 1.2” by Amulet has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from cool-films.z92527cf.bget.ru.
Publisher:
Groom-A-Zebu (tm)   (signed by Amulet)

Product:
Proxomitron

Description:
The Installer 1.2

Version:
4, 5, 0, 4

MD5:
9327f8b3c03a1df506eb94c88039f41b

SHA-1:
850c291111cf269e4eca1da5043b81573c82836c

SHA-256:
5b7831a175753c9f9d8ba417660e67fb3412c8051002b372dc37b80ca993d690

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/6/2024 9:38:55 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FileTour.Amulet.Installer (M)
16.6.12.15

File size:
1.6 MB (1,686,096 bytes)

Product version:
Naoko-4.5 2003-6-1

Copyright:
Copyright © 1999 - 2003 By Scott R. Lemmon

Trademarks:
Proxomitron, The, and the letters A-Z

Original file name:
Proxomitron.exe

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Amulet

Authority:
COMODO CA Limited

Valid from:
12/18/2015 2:00:00 AM

Valid to:
12/18/2016 1:59:59 AM

Subject:
CN=Amulet, O=Amulet, POBox=127015, STREET="Vyatskaya, 70, pom.1", L=Moscow, S=Moscow state, PostalCode=127015, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B48E86D275ECE7BFC0A62B206428EDAC

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:3778mogcGa/IlHcRKq9jsHjjUf4QMpL5H:3Bo9l88R39jsHjQ/MFZ

Entry address:
0x531000

Entry point:
E9, 30, 18, 00, 00, F1, 2F, 68, C1, DC, 05, 38, E9, F4, 02, 00, 00, BC, 8A, 44, 89, 1D, 00, 00, 00, 00, 68, 55, 1B, 93, 00, 9C, FF, 44, 24, 04, 9D, C3, CC, 68, 68, 2B, 93, 00, 9C, FF, 4C, 24, 04, 9D, C3, 9C, 89, 68, 6F, 79, 35, B5, 9C, 81, 6C, 24, 04, F6, 4F, A2, B4, 9D, C3, CD, 8D, 89, B8, 00, 00, 00, E9, F4, 09, 00, 00, 60, D3, C5, C3, E9, 3A, 15, 00, 00, 9A, 54, 05, 52, C6, 09, 00, 68, 30, 29, 93, 00, 9C, FF, 44, 24, 04, 9D, C3, 37, E8, BA, 68, BF, 4E, 00, 68, 05, 41, DA, 25, 9C, 81, 6C, 24, 04, B6, 27...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
885.5 KB (906,752 bytes)

The file cool-torrent.net_barbaruans.rising.2016.s01e01-03.hdtvrip-torrent.exe has been seen being distributed by the following URL.

http://cool-films.z92527cf.bget.ru/get/a.php?url=http://cool-torrent.net/.../download.php?id=12367&name=cool-torrent.net_barbaruans.rising.2016.s01e01-03.hdtvrip.torrent

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.