home

deadhunt_rus.exe

Zona installer

Destiny Media

The application deadhunt_rus.exe by Destiny Media has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from dl2.getz.tv.
Publisher:
Destiny Media  (signed and verified)

Product:
Zona installer

Version:
1.0.0.0

MD5:
b7a89eef09353355eecfbe60a62422c8

SHA-1:
040bc78db9bef65ed56a18edf7a99063c9ed7be7

SHA-256:
a17876fa175c86488197aa1527a22ff68d5b28fc58d6f998de67dcde55b652ea

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/24/2024 12:46:44 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DestinyM.Installer (M)
16.3.10.8

File size:
229.3 KB (234,808 bytes)

Product version:
1.0.2.6

Copyright:
Copyright (C) 2013

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\deadhunt_rus.exe

Digital Signature
Signed by:
Destiny Media

Authority:
VeriSign, Inc.

Valid from:
4/1/2013 3:00:00 AM

Valid to:
7/2/2014 2:59:59 AM

Subject:
CN=Destiny Media, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Destiny Media, L=Moscow, S=Moscow, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
12E105874BD7B6030B1F1ABB57C21D0D

File PE Metadata
Compilation timestamp:
5/12/2014 11:53:14 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:mSac5f/XbdJr5QiZLUMmlVV4nm+n0oETgSg6aMxNX21IoS4Vf65u:m0LSrbCm+nnKJDaIoS4A5u

Entry address:
0x973F0

Entry point:
60, BE, 00, 50, 46, 00, 8D, BE, 00, C0, F9, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 7E, 55, 09, 00, 57, 83, C3, 04, 53, 68, E1, 23, 03, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
208 KB (212,992 bytes)

The file deadhunt_rus.exe has been seen being distributed by the following URL.

http://dl2.getz.tv/tmp/e3/e5/.../deadhunt_rus.exe

Remove deadhunt_rus.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.