» garry s mod-13.2.exe
Overview
Analysis
File Details
Downloads (1)

garry s mod-13.2.exe

Melek

Parsec Media S.L.

The application garry s mod-13.2.exe, “Melek Setup ” by Parsec Media S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.senddeliveryshare.com.

File name:

Publisher:

Coladicide (signed by Parsec Media S.L.)

Product:

Melek

Description:

Melek Setup

MD5:

d89a0a194461681d4bb406332406a4cb

SHA-1:

1665c164f55e365bdd108416aa020f811521b468

SHA-256:

c291f52e205ca469bc1478a4625255d21e70d502bef56eeda61b857a3d20bf50

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/27/2024 4:40:13 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

17.3.13.8

File size:

1.2 MB (1,239,184 bytes)

Product version:

4.3

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\garry s mod-13.2.exe

Digital Signature

Signed by:

Parsec Media S.L.

Authority:

GlobalSign nv-sa

Valid from:

1/20/2016 9:02:38 AM

Valid to:

1/20/2017 9:02:38 AM

Subject:

CN=Parsec Media S.L., O=Parsec Media S.L., S=Barcelona, C=ES

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121664972E6D57B8AC3433073871EDF1FEA

File PE Metadata

Compilation timestamp:

6/19/1992 4:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9839

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file garry s mod-13.2.exe has been seen being distributed by the following URL.

http://www.senddeliveryshare.com/LXkDlK7q4SpCtQDqcqJCYKUQEx JjGrlrAbY48tNWagzeNFLlRDOPzp87W2u7il6WxPph9w0lc6oRXWs4UNQP9COeW8hh HFoA8iMnJCXVPQDODOskQIXNOLPEYc88O5GKSSdYJsxPKFPZdBeYfQ9DjkxuprIBdlIbWA9JS_rJDnLmhAOvz5PO5afjsexvMjFyJ7AHQN1vrfLtCUc0nN2I8FJKDqi_vkILUs KPTl5WOljAK3aYC5KibdWK3UyYSRxzp4g 36XI5V4ESXWZCmIW2Mr06FtNtPJ7i3ZYDldAsUYar9WQY YLc34z5p QgW9N11mHU96eQJ0XeThCiGH3mpQuY0pbMSeuxSLeUZ3PtNUpOl5s2fdbPlzOLBo6fUpScnDrwuUWXJ0iPdg60QsDTeTTb0LDXxQ__JyI2QQ6kaGUe8CiGtG75RM0j5Mv0mRE0kL7s-G0IAAETnFhMwtQRLdDg EmODouCQA9ZLQdoCl2BjDM8TaaQ3tmjN5lAK9GLmb2ugxbXqd6SJR9oZiyfjAQ==

Remove garry s mod-13.2.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.