home

freetvdownloader4.exe

Free TV Downloader

CoolMirage Ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application freetvdownloader4.exe by CoolMirage has been detected as adware by 7 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com.
Publisher:
Cool Mirage  (signed by CoolMirage Ltd.)

Product:
Free TV Downloader

Version:
1.1.5.0

MD5:
32ef9350487bd0563cc11d82b1f4fb94

SHA-1:
920bfae1f22f0fa69ce91a673047560146c28837

SHA-256:
e973f637e45a3f6827e403c26a80d06ca3fb53c5b98f508ad79315b4aec53ddc

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/27/2024 3:53:42 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/CoolMirage.VA.101
7.11.121.78

Comodo Security
UnclassifiedMalware
17480

herdProtect (fuzzy)
variant of moviedownloader.exe (Adware)
2013.12.28.12

Malwarebytes
PUP.Optional.CoolMirage.A
v2013.12.28.12

Reason Heuristics
PUP.CoolMirage.R
14.8.7.17

Trend Micro House Call
TROJ_GEN.F47V1026
7.2.362

VIPRE Antivirus
CoolMirage Ltd
24850

File size:
2.6 MB (2,716,664 bytes)

Product version:
1.1.5.0

Copyright:
Copyright © Cool Mirage 2013

Original file name:
Free TV Downloader.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\freetvdownloader4.exe

Digital Signature
Signed by:
CoolMirage Ltd.

Authority:
Thawte, Inc.

Valid from:
6/6/2013 2:00:00 AM

Valid to:
6/7/2014 1:59:59 AM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
10/8/2013 1:07:25 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:yKUeeOg2sssgMzAtwi2NlRp3j2J3pK761Y8SerqTRz3P9J+biO3+ukUIbaHvrr/G:RUeeOg2sssjEtwi2yJ5p17qTZeZkzMri

Entry address:
0x29362E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.6 MB (2,693,120 bytes)

The file freetvdownloader4.exe has been seen being distributed by the following URL.

http://cmpsmarter-downloader.maynemyltf.netdna-cdn.com/FreeTVDownloader4.exe

Remove freetvdownloader4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.