home

diary.ng.panget.2014.dvdrip.x264-aen.exe

Alexey Kurilenko

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application diary.ng.panget.2014.dvdrip.x264-aen.exe by Alexey Kurilenko has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from boxesists.com.
Publisher:
Alexey Kurilenko  (signed and verified)

MD5:
53cc073e1c5b94338300cd3b24ac2569

SHA-1:
bf080b212be58b072147fbff481b0747957daf36

SHA-256:
8bf716581b2253c88339bed112ad208157afedc73263686c24267f33c3667569

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/24/2024 12:10:33 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.AlexeyKu (M)
16.7.2.10

File size:
1.3 MB (1,345,912 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\diary.ng.panget.2014.dvdrip.x264-aen.exe

Digital Signature
Signed by:
Alexey Kurilenko

Authority:
Unizeto Technologies S.A.

Valid from:
6/17/2014 8:20:17 PM

Valid to:
6/17/2015 8:20:17 PM

Subject:
E=Alexey.kurilenko@hotmail.com, CN=Alexey Kurilenko, O=Alexey Kurilenko, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
15D51642691B3EE20985639A8FE865DD

File PE Metadata
Compilation timestamp:
12/6/2012 10:57:03 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:JIYiyznEmxZXdUF1Ko8WwsszQVFjIZ6rnqn+cwbO:JJrRUjC6qQVFIILqQbO

Entry address:
0x1F6AA

Entry point:
E8, 1D, 39, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 60, 94, 45, 00, E8, 50, 11, 00, 00, E8, EA, 3A, 00, 00, 0F, B7, F0, 6A, 02, E8, B0, 38, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C2, 09, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.8043

Code size:
333 KB (340,992 bytes)

The file diary.ng.panget.2014.dvdrip.x264-aen.exe has been seen being distributed by the following URL.

http://boxesists.com/hp/?q=ctg8/ruh0dSKxBCDWYRKAyMDLpHlecigWDeuGABOcaBM4i40nFGGR9OshK9G82zunEAbO83MPq1f/8S9pgagj3nx JjHejlWhpS7bs511W/mxlK/n WBq40CL8xLSeEqyX6pAJUMIjc11QBXBbTYVUve/.../41ZX59yXfRe0yzMQL 1UdASWchhNb7FZLqbpRcKNJ WeqJircKsJIah5kdu3yC8TMGY8MwMHPAMqhWaXUcGkJwA3&external_id=1420891363024625358

Remove diary.ng.panget.2014.dvdrip.x264-aen.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.