home

fullyfullversionpcgamedownload__15022_i1621435831_il23136.exe

LLC `FOTO-TSENTR `

The application fullyfullversionpcgamedownload__15022_i1621435831_il23136.exe by LLC `FOTO-TSENTR ` has been detected as a potentially unwanted program by 5 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. While running, it connects to the Internet address server-54-230-39-160.jfk1.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
LLC `FOTO-TSENTR `  (signed and verified)

MD5:
e0b252cd637bc1ae91ebdab82607f644

SHA-1:
78a574025c5f4c7e15abb1476d9123eb273e52f9

SHA-256:
71bc190ef50e4e7dc9853281bd9cdd11d08707f66a44ad6389bb5856dab4209b

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 1:40:38 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Amonetize.41
520

Avira AntiVirus
ADWARE/Amonetize.Gen
8.3.2.2

Arcabit
Trojan.Application.Bundler.Amonetize.41
1.0.0.425

Bitdefender
Gen:Variant.Application.Bundler.Amonetize.41
1.0.20.1230

Reason Heuristics
PUP.FOTOTSENTR (M)
15.9.7.22

File size:
737.7 KB (755,376 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\programs\fullyfullversionpcgamedownload__15022_i1621435831_il23136.exe

Digital Signature
Signed by:
LLC `FOTO-TSENTR `

Authority:
COMODO CA Limited

Valid from:
7/10/2015 3:00:00 AM

Valid to:
7/10/2016 2:59:59 AM

Subject:
CN=LLC `FOTO-TSENTR `, O=LLC `FOTO-TSENTR `, STREET="Bud. 13-A kv. 1, Bolshaya Morskaya", L=Mykolayiv, S=Mykolayivska, PostalCode=54001, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
4EA3FDADC06CB2C406A598621402321B

File PE Metadata
Compilation timestamp:
9/3/2015 1:02:36 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:QIchNl7rNgJgmmr3Zai2lOeMeviY5hh+k30X6e5D+SYuUe6FNtCi/N:BCDfNmgmmbZZ2lOeMevl5hhN3M9+SYu8

Entry address:
0xE8A0

Entry point:
E8, 19, 41, 00, 00, E9, 39, FE, FF, FF, 55, 8B, EC, A1, 04, 3D, 43, 00, 85, C0, 75, 1D, E8, FA, 2F, 00, 00, 6A, 1E, E8, 50, 30, 00, 00, 68, FF, 00, 00, 00, E8, 70, 26, 00, 00, A1, 04, 3D, 43, 00, 59, 59, 8B, 4D, 08, 85, C9, 75, 01, 41, 51, 6A, 00, 50, FF, 15, 5C, 70, 42, 00, 5D, C3, 55, 8B, EC, 56, 8B, 75, 08, 83, FE, E0, 77, 6F, 53, 57, A1, 04, 3D, 43, 00, 85, C0, 75, 1D, E8, B2, 2F, 00, 00, 6A, 1E, E8, 08, 30, 00, 00, 68, FF, 00, 00, 00, E8, 28, 26, 00, 00, A1, 04, 3D, 43, 00, 59, 59, 85, F6, 74, 04, 8B...
 
[+]

Entropy:
7.6513

Code size:
150.5 KB (154,112 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-39-160.jfk1.r.cloudfront.net  (54.230.39.160:80)

TCP (HTTP):
Connects to server-205-251-251-79.jfk5.r.cloudfront.net  (205.251.251.79:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.