home

global ship traffic seen from space.avi.exe

The application global ship traffic seen from space.avi.exe has been detected as a potentially unwanted program by 23 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from wfs.ezdownloadpro.info and multiple other hosts a web site host known to distribute potentially unwanted software operated by Rafael Leviev.
MD5:
d101f98f0bf5426d8ae6a7cc03bfa674

SHA-1:
7b3924db88572107f7383f40e5b8c03beba71ea3

SHA-256:
8471c1d8444e88fe9ee5bc206cfa0992d9bb6023af2f8f0d77b161cb73c53588

Scanner detections:
23 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 1:43:00 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
6736976

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.03.09

Avira AntiVirus
ADWARE/MultiPlug.Gen
7.11.214.252

AVG
PSW.Generic12
2016.0.3176

Bitdefender
Gen:Variant.Adware.Mikey.8516
1.0.20.340

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
21347

Dr.Web
Trojan.DownLoader12.35418
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.FK application
7.0.302.0

F-Prot
W32/MultiPlug.H.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey
5.13.68

G Data
Gen:Variant.Adware.Mikey.8516
15.3.25

K7 AntiVirus
Unwanted-Program
13.200.15197

Malwarebytes
PUP.Optional.Unizeto
v2015.03.09.04

McAfee
Trojan.PWS-Zbot.gen.ep
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
16.0.0.204

NANO AntiVirus
Riskware.Win32.MultiPlug.dorspi
0.30.0.296

Panda Antivirus
Generic Suspicious
15.03.09.04

Reason Heuristics
Threat.Win.Reputation.IMP
15.3.9.4

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.15307

Sophos
PUA 'MultiPlug' (of type Adware)
5.11

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

Zillya! Antivirus
Adware.MultiPlug.Win32.225864
2.0.0.2091

File size:
1 MB (1,075,712 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\ProgramData\{ca2895c9-2a64-3b76-ca28-895c92a65724}\global ship traffic seen from space.avi.exe

File PE Metadata
Compilation timestamp:
7/29/2012 5:40:38 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:SUqMzssU+nFTtKaLDYAV93ZRBIr/8WEq9lUU9VHN8IW17V1V0qbpKHGfWwuMBB:XJFtKaHYE3B7WdlZVtvW17XV0mo6

Entry address:
0xDF7B2

Entry point:
E8, DF, 14, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 30, 2E, 4F, 00, E8, E8, 19, 00, 00, E8, AC, 16, 00, 00, 0F, B7, F0, 6A, 02, E8, 72, 14, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, E8, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
912.5 KB (934,400 bytes)

The file global ship traffic seen from space.avi.exe has been seen being distributed by the following 3 URLs.

http://wfs.ezdownloadpro.info/hp/?q=x6/L4TVFHDRajPZ5wyOsmMcLzCYYxXrsmMl9lc0ftc5a3ucCnQUJn7o6wMSm4YgzkTSdOZClr7X/ZsTtLbA7JMazF6gNgkMITZ8y6HG78zFU1GzUDWV1ZaQ0robVwrPBf2RZYOxedFlp7obuTmu9Qd6xX6bmEwfiEBJZNV6KweLfci2Jyf4NZjsv1KLKgdhWINu5jsUZBRzMmxXdKQL1nxBPhh9LBDEZ0iVicB0kmquCnOQkl84JSFAY85z9potoZNfkIamQ54HfGv2XDMgYjQ08n/UDuRM30Dmhvji lLcoF4Le yULDO7I5N3EpC24Q4JrRZeOlea/Ei1bE/.../ux4260uYsUM&uuid=sF4gONO9OK1hkNimTXX3LAvGItiARfW6ercta9j4faLdqEmLVHJAsb0gHzKfVIlGSJuICRzjZnuwadDAzRUUQqRSXTqIz9nGjAlvDCPEDvoKTqAKgP5Iym1pNkpka8xEhSuuwmkCgCI6vh2KvbE5ulglxDXDoZ1LtcUmasnLKLODKMYg0I7B2kx4ctPDBUwxCgaOrbZEnpNdSnRVYUppNffZpiwjcRxnCfESpd8xFLVg8S4YCdaPhcJrkHw2b6Z8kGvUm29HCiS75jvX3cULBBaMdIpiqSl8vOLhMovbvJwoA5fgb3FspeY5rMEXKS1waQK7gNdVxDEBpFDeNJ1nvJGDmdqM5cmGc8ZbmPMuVRgRoRXYolOu3oVs4mXzFxDVLBMF8wt0pkBPD2AWGUZLZJKWwgc

http://wfs.ezdownloadpro.info/hp/?q=lXdSMS2fWIa1fPRJLFvosOcvfoYhw9ySN0gB6IxJE0la8clWUoUws8AUqOON4G19Kd1pqbhlnHKaz1k/CwZU/Y3uuNVQ 7lzKgB2ccdhQKeTZ9pN2BbbBtBpPflEv0g7klOEfYv6iKmXABM 48IbBt6SD0PndlCmoBGQ9DkoQ4onfSEBj59iJ3gx0TTceHcTupqMzQghQuhPHzU5kKsFIbBMbHMDtSRbb km9gDJ/p/wQG8dC/y7Z6Nwmx0cchQyH5dfnUpVxnEdiMmItwVEdRFPLpCRmz/oM35YtZVElF2hiQ3IvMLm6R5KU23eSfeIZQSjIiJuwJlvyOrBYJcswQmyQ7U1l0oh0glwSnFZpA00snevYRDbctCTQDBNYE1TfdqDvFUbiNutMBxIty1N767/pC7pX6xRmXWTz/1JVCEVWo9Xwup42zUSt304NC3d/H12UmF7UobfGtyA5yJFc8VEbL8nLbaC1Y/pOTuYuCaaltlJE7ZCEcLoZ6v3b24MhQOnNIajPKu6Y5quNNRK2gpP8RbDXE7XCh5O97J5ai4wt/s7xuMicc4pLTyKkTZ0uCK4u/u4/v6l5BZwJwZsknR4MZHuw7ucOlNiR2hsPH/.../ovLoOhHO pj0IqRfOMt kBVWMb2DiE7BpZ7lUSQtTPFIHP7N8lalkZttZSQicsFv5uTGR1dOqkeqTL4fL d7c0dH2zTZ6Nwv4Ij4wBLQ63ggeasFP

http://wfs.ezdownloadpro.info/hp/?q=lXdSMS2fWIa1fPRJLFvosOcvfoYhw9ySN0gB6IxJE0la8clWUoUws8AUqOON4G19Kd1pqbhlnHKaz1k/CwZU/Y3uuNVQ 7lzKgB2ccdhQKeTZ9pN2BbbBtBpPflEv0g7klOEfYv6iKmXABM 48IbBt6SD0PndlCmoBGQ9DkoQ4onfSEBj59iJ3gx0TTceHcTupqMzQghQuhPHzU5kKsFIbBMbHMDtSRbb km9gDJ/p/wQG8dC/y7Z6Nwmx0cchQyH5dfnUpVxnEdiMmItwVEdRFPLpCRmz/oM35YtZVElF2hiQ3IvMLm6R5KU23eSfeIZQSjIiJuwJlvyOrBYJcswQmyQ7U1l0oh0glwSnFZpA00snevYRDbctCTQDBNYE1TfdqDvFUbiNutMBxIty1N767/pC7pX6xRmXWTz/1JVCEVWo9Xwup42zUSt304NC3d/H12UmF7UobfGtyA5yJFc8VEbL8nLbaC1Y/pOTuYuCaaltlJE7ZCEcLoZ6v3b24MhQOnNIajPKu6Y5quNNRK2gpP8RbDXE7XCh5O97J5ai4wt/s7xuMicc4pLTyKkTZ0uCK4u/u4/v6l5BZwJwZsknR4MZHuw7ucOlNiR2hsPH/9ycvORPTukPN6ZOANalUtVFOy4XWeSv0yoKzRgZMH6GsFs0Be81xZmaAZuKa8qU0t2F1yiH7XXFd5I7xJOyoHAC8WymltfhNq ZBjDwLHdKFMmuMJGjV4OexZIygNuHkTfnhgdNs0ezrsGoHjrwK9b M3p4iPoZuTRFRSSHHTr5U0XWvOqNP6CSKQ/.../7Ig

Remove global ship traffic seen from space.avi.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.