freetvdownloader4.exe

Free TV Downloader

CoolMirage LTD.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application freetvdownloader4.exe by CoolMirage has been detected as adware by 5 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com.
Publisher:
Cool Mirage  (signed by CoolMirage LTD.)

Product:
Free TV Downloader

Version:
1.9.0.9

MD5:
e9aab122ac2ff365f08dddda21442cd4

SHA-1:
55f44fde9f24e4c852ee64cb4daa789b59dd708c

SHA-256:
4084f8945a29a0fc3b7e37117dce6e8ce147d132e58b2aaf3d0f4bfac45f3d8e

Scanner detections:
5 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/27/2024 1:33:46 AM UTC  (today)

Scan engine
Detection
Engine version

herdProtect (fuzzy)
2014.11.6.20

Panda Antivirus
PUP/MultiToolbar.A
14.09.12.06

Reason Heuristics
PUP.CoolMirage.R
14.9.12.6

VIPRE Antivirus
CoolMirage Ltd
27408

File size:
2.6 MB (2,702,528 bytes)

Product version:
1.9.0.9

Copyright:
Copyright © Cool Mirage 2013

Original file name:
FreeTVDownloader.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\freetvdownloader4.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
8/26/2014 2:00:00 AM

Valid to:
11/10/2015 12:59:59 AM

Subject:
CN=CoolMirage LTD., O=CoolMirage LTD., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
029E9B7F7CD982D1F52BA19EDA66E340

File PE Metadata
Compilation timestamp:
3/6/2014 10:04:08 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:TKUev9gzgMzAtwi2NlRp3j2J3pK761Y8SerMTRz3P9J+biO3+ukUIbaHvrr/AHZs:OUev9gzjEtwi2yJ5p17MTZeZkzMreXk1

Entry address:
0x28FE9E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.6 MB (2,678,784 bytes)

The file freetvdownloader4.exe has been seen being distributed by the following URL.

Remove freetvdownloader4.exe - Powered by Reason Core Security