home

fizruk-2-sezon-28201429-satrip-c2bb-filmy-2c-novinki-kino2c-serialy2c-pesni-iz-filmov2c-pesni-iz-ser

LLC

The file fizruk-2-sezon-28201429-satrip-c2bb-filmy-2c-novinki-kino2c-serialy2c-pesni-iz-filmov2c-pesni-iz-ser by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from ruru-gorodrob.ru.
Publisher:
LLC   (signed and verified)

Version:
1.3.4.8

MD5:
f4767a4f6a625edc0bce078e54f288a5

SHA-1:
5a817876e362aef05e0598588c8a25c55eacd555

SHA-256:
18205a43a9345d14f7e2a76023bd0a64aeb33c0e3ba0e30abe25d7d019dac577

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/27/2024 12:46:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Amonitize (M)
16.2.1.9

File size:
3.8 MB (3,981,272 bytes)

Product version:
1.3.4.8

Common path:
C:\users\{user}\downloads\fizruk-2-sezon-28201429-satrip-c2bb-filmy-2c-novinki-kino2c-serialy2c-pesni-iz-filmov2c-pesni-iz-serialov2c-pesni-iz-multf.exe

Digital Signature
Signed by:
LLC

Authority:
COMODO CA Limited

Valid from:
10/1/2015 3:00:00 AM

Valid to:
10/1/2016 2:59:59 AM

Subject:
CN="LLC ""AZ SOFT""", O="LLC ""AZ SOFT""", STREET="Vulytsya Dalnytska, Budynok 23/4, Ofis 310", L=Odesa, S=Odeska, PostalCode=65005, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3CCA67117AE7C5BE2F99ECBA3ECC9F69

File PE Metadata
Compilation timestamp:
12/27/2011 10:44:54 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
49152:PNd4lYGJYzPtnKtQfj8HxR8io3yNpxo3t5B:PNWtYzPtnKtQfhioCN49H

Entry address:
0x14AED0

Entry point:
55, 8B, EC, 81, EC, 70, 03, 00, 00, C7, 85, 9C, FE, FF, FF, 3D, E4, 07, 00, 81, 7D, A8, D7, 30, 0A, 00, 76, 16, C7, 85, 38, FE, FF, FF, 00, 00, 00, 00, C7, 85, 0C, FF, FF, FF, 00, 00, 00, 00, EB, 07, C7, 45, F8, 21, 49, 0A, 00, 8B, 45, B4, 3B, 45, 88, 72, 05, E9, F2, 00, 00, 00, 8B, 8D, 50, FF, FF, FF, 89, 8D, 28, FE, FF, FF, 83, BD, 28, FE, FF, FF, 35, 74, 17, 83, BD, 28, FE, FF, FF, 7D, 74, 1D, 81, BD, 28, FE, FF, FF, 83, 00, 00, 00, 74, 1C, EB, 26, 0F, B6, 95, BF, FE, FF, FF, 89, 95, A0, FE, FF, FF, EB...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
1.3 MB (1,410,560 bytes)

The file fizruk-2-sezon-28201429-satrip-c2bb-filmy-2c-novinki-kino2c-serialy2c-pesni-iz-filmov2c-pesni-iz-ser has been seen being distributed by the following URL.

http://ruru-gorodrob.ru/145410529030675/fizruk-2-sezon-28201429-satrip-c2bb-filmy-2c-novinki-kino2c-serialy2c-pesni-iz-filmov2c-pesni-iz-serialov2c-pesni-iz-multf/file/.../

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.