home

dsrlte.exe

Pay-by-Ads Ltd

The application dsrlte.exe by Pay-by-Ads has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered by a time event.
Publisher:
Pay-by-Ads Ltd  (signed and verified)

MD5:
2af3b5d641ecbd057ff0461a5ba3ffa8

SHA-1:
d19af9edb1616c7a09a9c8a2ff43a4a911906db3

SHA-256:
379d5ef2fb5010f319e973c44886a911857262a70eb074ffcbeed8007938912c

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/24/2024 1:44:34 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Montiera.PaybyAds (M)
16.6.20.13

File size:
522.9 KB (535,472 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\pay-by-ads\yahoo! search\1.3.8.2\dsrlte.exe

Digital Signature
Signed by:
Pay-by-Ads Ltd

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 4:45:20 AM

Valid to:
12/16/2014 6:54:24 AM

Subject:
CN=Pay-by-Ads Ltd, O=Pay-by-Ads Ltd, L=Tel aviv, C=IL

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B0FFF59FB803E

File PE Metadata
Compilation timestamp:
6/12/2014 2:07:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
384:NWRFt29emjZVl3Ozld4MT2M0HsCICIXMWGc0zc2twhOv7Gp1Jt6pVENNzoCnYPL4:NWPtyjPlGl+9n4quK6p1fyCJG/U

Entry address:
0x3D316

Entropy:
0.5035

Code size:
320.5 KB (328,192 bytes)

Scheduled Task
Task name:
Yahoo! Search

Trigger:
Time


Remove dsrlte.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.