freetvdownloader.exe

Free TV Downloader

CoolMirage Ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application freetvdownloader.exe by CoolMirage has been detected as adware by 2 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com.
Publisher:
Cool Mirage  (signed by CoolMirage Ltd.)

Product:
Free TV Downloader

Version:
1.1.5.0

MD5:
191ecaafdadb2c2c2669680bf24477db

SHA-1:
cc97694340e85d55998cdea573fb8d28f9496085

SHA-256:
e0cc00b1ece2a80d5b3641d3d5e0607f3be25b5cb1f794559c81c423b295bb4e

Scanner detections:
2 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/27/2024 1:29:14 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.CoolMirage.Q
14.8.7.17

VIPRE Antivirus
CoolMirage Ltd
23088

File size:
2.6 MB (2,722,808 bytes)

Product version:
1.1.5.0

Copyright:
Copyright © Cool Mirage 2013

Original file name:
Free TV Downloader.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\freetvdownloader.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/6/2013 12:00:00 AM

Valid to:
6/6/2014 11:59:59 PM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
10/8/2013 11:07:25 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:2VPk6KDT1Y8Z+2kUXbDiueAYcgCCCGMzAtww2NlRp3j2JVpK761Y8EefOtzV3P9u:ejk1LkAyueAYcgCCC9Etww2yJTp1VOt6

Entry address:
0x294F8E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.6 MB (2,699,264 bytes)

The file freetvdownloader.exe has been seen being distributed by the following URL.

Remove freetvdownloader.exe - Powered by Reason Core Security