home

download.exe

The application download.exe has been detected as a potentially unwanted program by 13 anti-malware scanners. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. The file has been seen being downloaded from f.websited.link.
MD5:
0961a766586810802f6100bf918d0e8c

SHA-1:
06d40481000ed56860ac3c495851d406135f3508

SHA-256:
0c91a3424082dd39bcfdabd7ef28f5e9a5255d61e2f54d206d8272fb203a531c

Scanner detections:
13 / 68

Status:
Potentially unwanted

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
1/13/2025 4:59:04 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mplug.41
5970718

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.05.11

avast!
Win32:MultiPlug-ZC [PUP]
150319-1

Bitdefender
Gen:Variant.Adware.Mplug.41
1.0.20.650

Dr.Web
Trojan.Crossrider1.29239
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Mplug.41
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.JZ application
7.0.302.0

F-Secure
Gen:Variant.Adware.Mplug
5.13.68

G Data
Gen:Variant.Adware.Mplug.41
15.5.25

K7 AntiVirus
Unwanted-Program
13.203.15861

MicroWorld eScan
Gen:Variant.Adware.Mplug.41
16.0.0.390

Reason Heuristics
Threat.Win.Reputation.IMP
15.5.10.16

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
3.12.26.3

File size:
2.2 MB (2,356,224 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\download.exe

File PE Metadata
Compilation timestamp:
9/20/2012 1:44:03 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:ieGdtv46eBVMQDbZgY5qfu1UEi5sxyCJUH2P0:i0VzBqW1gsxyCJw2P0

Entry address:
0x206AB

Entry point:
E8, 54, 12, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C0, C9, 5C, 00, E8, 5F, 17, 00, 00, E8, 21, 14, 00, 00, 0F, B7, F0, 6A, 02, E8, E7, 11, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C8, 0B, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
1.2721

Code size:
150 KB (153,600 bytes)

The file download.exe has been seen being distributed by the following URL.

http://f.websited.link/hp/?q=Nan5yVC/tJEggPRJLFvn4FXJ8gAIRci9CmJ3oZNNzwVzlDZsppSw81PNHf8XxsA J0I1vmsEQm7k/HxRuU1Segmt 4ELmK2HRcKxoOVQFxXplMqHGFP1/7/.../VxuGvMg QFGEbdRQTp3P1RwBegjfwD3b2z4NZVW41wdKLPXoj9VKGPfnsYH5oLAI4zMFtuZxumt5IIYJZ9t1fW1YGcD3tT6jhW7&external_id=1431288794961590571&uuid=VgqpZ76TcCGA7GhpCW545srnGP7vrh88C7SeWWGVUGMkO1wJesu2fqCjNLL60tqMNS2U9I5M99XwCOiPe8rtX8swWPP0DQcvKpfVuKZo7Cq2MljJkFJZefVUMWmEZrz5bouW9ArOQMDAxv76OOAUsp3vT7d7lwraXhrzcSDOdasJ8MYzSEUutVfSjjWY5YdgSUEWrb5YVya1kf897gDYG7UwdK1IrYBxhboinBqVJiVOnrXA1VYdb9vZpcNPmjL9brkD7iomeUZ3LXFFVB3D9gkNfJusOVHs4GksLRGQ612dfImrXYFo5skp7wYe6gttzNSnViCCvQ5KGFrz6el843Cq3sqiVgTvlMq0DoHLrk3T1vBKQaQCn7c1XVL6YiwlEwI7F1yhJhuT5r2qArvYxGaWO5X9ryjyBIPWvTn70e1HcHy8qPeuTKz0yjbMcsbAAmGMaAnB2TUjus7snzxRYNrI10MwEv8uhMpuNKToyMiJwAl73y63zNJ7KCpjCQheMt4gmiqSMrgCklgCfoMsey9o2yUhkOirfPxZeYQLPkVEwnlB5GG48pQYLgTS5S31HFj71omJ6UOkDTPv922Ku6dzxaNOljre1AHL7CKmD8LQP79SSXoUyMtENxopkf5G6b5P9adgLTexsAsiLE9VXXq1Y98vNvBkxFoTEFgGfWB

Remove download.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.