home

goforfiles_downloader.exe

GoForFiles Installer

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application goforfiles_downloader.exe by Righway Technologies, Inc has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.
Publisher:
http://goforfiles.com  (signed by Righway Technologies, Inc)

Product:
GoForFiles Installer

Version:
1, 0, 262, 1

MD5:
1d6ccc880c0fbca2ea45ab001fa25c2c

SHA-1:
ddeecf22c02d941e8a7e6d3aa153206cb2ad6337

SHA-256:
40472ffaa7400ec767a943b82e34169ae430f2be1e4c21d0fc57f1bc05754581

Scanner detections:
23 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 11:52:24 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.29
361

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
Adware/Downware.4798
7.11.177.146

avast!
Win32:Adware-gen [Adw]
2014.9-160208

AVG
Righway Technologies
2017.0.2839

Bitdefender
Gen:Variant.Application.Bundler.29
1.0.20.195

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.EDown.FTVP
20904

Dr.Web
Adware.Downware.4798
9.0.1.039

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.29
8.16.02.08.11

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application
10.7.0.302.0

F-Secure
Riskware.Gen:Variant.Application.Bundler
11.2016-08-02_2

G Data
Gen:Variant.Application.Bundler.29
16.2.25

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.193.14817

Malwarebytes
PUP.Optional.Downloader
v2016.02.08.11

MicroWorld eScan
Gen:Variant.Application.Bundler.29
17.0.0.117

Norman
Gen:Variant.Application.Bundler.29
11.20160208

Reason Heuristics
PUP.Via Advertising.Bundler
16.2.8.23

Sophos
PUA 'Go For Files'
5.10

Vba32 AntiVirus
Signed-Downware.ExpressDownloader
3.12.26.3

VIPRE Antivirus
Threat.4925438
33706

Zillya! Antivirus
Trojan.Black.Win32.21765
2.0.0.2049

File size:
2.8 MB (2,969,880 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://goforfiles.com (C) 2014

Original file name:
GoForFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\goforfiles_downloader.exe

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 5:30:00 AM

Valid to:
8/23/2015 5:29:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
9/15/2014 5:02:22 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:OS9TCdKa5GLnVNRE/jRimvVgM0wquT0b4dEEdiTfz28+RIvM4Ow+D/aX9z8bxYL:OSJ9a5qNCxvVgMBqN8XdiDKrOUVnDaaC

Entry address:
0x847FA

Entry point:
E8, 63, 27, 01, 00, E9, 00, 00, 00, 00, 6A, 14, 68, F8, 41, 4E, 00, E8, 20, BC, 00, 00, E8, BE, 6C, 00, 00, 0F, B7, F0, 6A, 02, E8, F6, 26, 01, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D8, E8, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.3831

Code size:
766 KB (784,384 bytes)

The file goforfiles_downloader.exe has been seen being distributed by the following URL.

http://dlw644.goforfiles.org/.../HlfDy4gCFqooAlfbmNZhXymS1LvpcKTYOBHkKFxFoHwp4DU4tqTg3KcRMxr2EUNYAwCyKdcOc9knDzfGN25nBwefwFa07mMHhX7l9ZZ70TdRDcIj5dxFN5W4ERQU2WWxUb3whHJcYdWBre5g16neVbONH Sij x3Jzs68i

Remove goforfiles_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.