home

fileviewpro_1.5.0.0_keygen_downloader.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application fileviewpro_1.5.0.0_keygen_downloader.exe by Righway Technologies, Inc has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from y.gofor-files.net.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 464

MD5:
21e9a8ea07a103f2dada527f6513a06e

SHA-1:
15f05a89f10bcb9fa0549e003012415406f0736a

SHA-256:
a1183c7df59c340c26d1cc652ea903d650d400b23077565b71a594d9b1ab5c08

Scanner detections:
15 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/15/2024 12:26:36 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.426646
904

avast!
Win32:Adware-gen [Adw]
2014.9-140814

AVG
Righway Technologies
2015.0.3382

Bitdefender
Gen:Variant.Adware.Kazy.426646
1.0.20.1130

Dr.Web
Adware.Downware.4798
9.0.1.0226

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.426646
8.14.08.14.04

ESET NOD32
Win32/ExpressDownloader.H potentially unwanted application
8.7.0.302.0

F-Secure
Gen:Variant.Adware.Kazy.426646
11.2014-14-08_5

G Data
Win32.Application.ExpressDownloader
14.8.24

herdProtect (fuzzy)
variant of paretologic_filecure_1.1.1.0_serial_downloader.exe (Adware)
2014.10.29.22

Malwarebytes
PUP.Optional.GoForFiles.A
v2014.08.14.04

MicroWorld eScan
Gen:Variant.Adware.Kazy.426646
15.0.0.678

Reason Heuristics
PUP.RighwayTechnologies.c
14.8.14.11

Sophos
Go For Files
4.98

VIPRE Antivirus
Threat.4925438
31208

File size:
7.4 MB (7,791,520 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Turkish (Turkey)

Common path:
C:\users\{user}\downloads\fileviewpro_1.5.0.0_keygen_downloader.exe

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 3:00:00 AM

Valid to:
8/23/2015 2:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
8/6/2014 7:25:18 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
196608:RM6G2Z4raDWj6jD0rBfPg8d55riRJ4jTYB66yTgJQ:RM6lWj6ihX5WRbBFyKQ

Entry address:
0x3D50F

Entry point:
E8, A0, EF, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 50, F5, 46, 00, E8, 2B, 78, 00, 00, E8, C2, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, 33, EF, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 79, B5, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
359.5 KB (368,128 bytes)

The file fileviewpro_1.5.0.0_keygen_downloader.exe has been seen being distributed by the following URL.

http://y.gofor-files.net/j5GjXm7Vv1Jjw71NZZPgbTuS5Wki67Iub6O4ITy8km4v NVvEuPQbRPsyyxfuoYOR7jIVgLQy1wCwo4aWIFlTg/cNUV1xC8LJ4Z5ES KTuoqwSahJW1w72sxLb58fFjjOzFW ARkXvoUcQvrGHlXxQd/atMLUFyWQwJewxNLKo5PCjDWv3MBnepTcNrkHiei4lUxmOYpNK6rdWn/onhT56d5XfHWOQS m2VZ75JoQ9eXaU3B0QEN1oJCDZ3VDPSQyjPsk/.../7FauLuhSsYg==

Remove fileviewpro_1.5.0.0_keygen_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.