home

directx.exe

Mindad media Ltd.

The application directx.exe by Mindad media has been detected as adware by 8 anti-malware scanners. The file has been seen being downloaded from direct.download-free-videos.com.
Publisher:
Mindad media Ltd.  (signed and verified)

MD5:
ed3ca701d4c499fd8262d3d9ad4e16a5

SHA-1:
e6e40ad3fffe06d0aeea79001a54289e52d01cca

SHA-256:
834a1b69b5af9aa88712112029f284bdcf0ccb55b31c7dedc0d2435cf69f7080

Scanner detections:
8 / 68

Status:
Adware

Explanation:
Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Analysis date:
12/26/2024 11:06:05 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dropper.Gen
7.11.30.172

AVG
Generic
2015.0.3419

ESET NOD32
Win32/Bundlore.L potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.Win32.Bundlore
t3scan.1.6.1.0

McAfee
PUP-FLY
5600.7075

Reason Heuristics
PUP.Mindadmedia.H
14.8.7.21

Sophos
DomainIQ pay-per install
4.98

VIPRE Antivirus
Threat.4784459
31088

File size:
282.3 KB (289,064 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\directx.exe

Digital Signature
Signed by:
Mindad media Ltd.

Authority:
COMODO CA Limited

Valid from:
8/4/2013 7:00:00 PM

Valid to:
8/5/2014 6:59:59 PM

Subject:
CN=Mindad media Ltd., O=Mindad media Ltd., STREET=hamenofim 9, STREET=herzeliya, L=herzeliya, S=herzeliya, PostalCode=46725, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0E7140EE5347CFF2FBDBE59A34386099

File PE Metadata
Compilation timestamp:
7/6/2014 5:02:34 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:HLuP7PIXEWhPzCwPHZ01N2UM1+VBa5+xJhAiZVA:HLuPLoEWhP2SHZaNXDVBa5+53A

Entry address:
0x4536

Entry point:
E8, 01, 46, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, B0, 9D, 41, 00, E8, F4, 1E, 00, 00, E8, D2, 47, 00, 00, 0F, B7, F0, 6A, 02, E8, 94, 45, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 53, 3D, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.5130

Code size:
73.5 KB (75,264 bytes)

The file directx.exe has been seen being distributed by the following URL.

http://direct.download-free-videos.com/lp/f357b5f0/download.php?AppName=DirectX&DownloadUrl=http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/dxwebsetup.exe&SilentParams= /Q &ThankYouPage=http://www.updatedirectx.com/shared/static_pages/ThankYou.php&eulaLink=http://www.updatedirectx.com/shared/static_pages/EULA.php&ppLink=http://www.updatedirectx.com/shared/static_pages/PrivacyPolicy.php&BannerImage=http://www.updatedirectx.com/shared/static_pages/.../logo-default.gif&clickid=6d669d0c05e0e1f48f0ca69672732e61&affid=p100&subid=&hash=cdfbce1b6aa0553c5b98a15bc8b4d5bd186a09e13ee8ddfd2a447ea388f1a217&filename=DirectX.exe&gc=1

Remove directx.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.