home

gta_san_andreas_multiplayer_samp_0.3e[eeee].exe

Zona installer

Chetvertoe pokolenie, OOO

The application gta_san_andreas_multiplayer_samp_0.3e[eeee].exe by Chetvertoe pokolenie, OOO has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.towernewlaboratory.com and multiple other hosts.
Publisher:
4th generation  (signed by Chetvertoe pokolenie, OOO)

Product:
Zona installer

Version:
1.0.7.4

MD5:
c6f534ba0203d401ecd7d68609929d7c

SHA-1:
63108c09cad7d03123996f8478bbad0621846b00

SHA-256:
456552cfd4a7d5aa0c8d3cd23522cda5178b2deb760a630fedcbed1d991dd3ab

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/1/2024 9:31:48 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Zona.Chetvert.Installer.Meta (M)
16.7.11.16

File size:
831.7 KB (851,632 bytes)

Product version:
1.0.7.4

Copyright:
Copyright (C) 2015

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\gta_san_andreas_multiplayer_samp_0.3e[eeee].exe

Digital Signature
Signed by:
Chetvertoe pokolenie, OOO

Authority:
COMODO CA Limited

Valid from:
6/27/2016 3:00:00 AM

Valid to:
8/31/2017 2:59:59 AM

Subject:
CN="Chetvertoe pokolenie, OOO", O="Chetvertoe pokolenie, OOO", STREET="prospekt Lenina, 41A", L=Chelyabinsk, S=Chelyabinskaya oblast, PostalCode=454091, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2B28001B5ABFAC6B6A3858A0727C9B36

File PE Metadata
Compilation timestamp:
7/8/2016 12:23:22 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:mVoe9uwCeBpXjYTkp7Fxo1vXPHo1CEem00ARGUtg83UaS:wBBp0TkRFxopPI1mRGUDkaS

Entry address:
0x56644

Entry point:
E8, A6, 4C, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8D, 45, 18, 50, 6A, 00, FF, 75, 14, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, A4, 27, 00, 00, 83, C4, 18, 5D, C3, 8B, FF, 55, 8B, EC, 8B, 45, 14, 56, 85, C0, 74, 41, 83, 7D, 08, 00, 75, 13, E8, BA, 1B, 00, 00, 6A, 16, 5E, 89, 30, E8, 14, 3E, 00, 00, 8B, C6, EB, 2A, 83, 7D, 10, 00, 74, E7, 39, 45, 0C, 73, 0E, E8, 9C, 1B, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, DE, 50, FF, 75, 10, FF, 75, 08, E8, 06, FA, FF, FF, 83, C4, 0C, 33, C0, 5E, 5D, C3, 8B, FF...
 
[+]

Code size:
482.5 KB (494,080 bytes)

The file gta_san_andreas_multiplayer_samp_0.3e[eeee].exe has been seen being distributed by the following 4 URLs.

http://www.towernewlaboratory.com/tupUYb8beZ0w uaByKBElvf4JlVmiBzF2XeMcpIE_I_x6N30E2sPUzo8UE2HrcR3vn nsnbejYDyiuInUIGTaFg2Ki4DW0nh6QvLWoezJ8AKLPHfTBdapdGgboX Kyj3p35OwZtXnQdRuzizqzcQcyAhWLLGQ3wY7s3sZOi y 3KS8pPGWzkIgpyaxObSMOk9ugLlroP-G0cAAMTaOW6vDKthMkuXIgb6z78IbMCJBuaTBTgALvfHdWiHmZCoOqmIoE1X_1U38ONj8Fishgt2sNh9FOZW8j2EmKm9Bg==

http://www.towernewlaboratory.com/WHr8MzOLiZ_LhC3EGoop_ Yp39x4Os7gWyI9Or9FPpKpZzzbTUe4R 8ZyMf_RNX2QXcHHVkc1zcJIXuMfIUviLhBVGA Pcaau6UnP_b9sfgAzKsQAQmn7U3Dfk0AMJCnHSqL 7DXp_gZm8gEGyB_ctnu8MOrPz9gl cJhhHBUHPguDfpG9c2NS3U 9U6np_JpznJo3szlxFCjBGD4uXcQCP2Suic6A==-G28AAMSgebENTnG h0fo5EQPxj8e7BhgANSWtQUbY62hOCtznmsSTYweXddoxfX7n8MXO_1uuVNYCN8hxo9ilPNyLziLTCsV NM8QOgNb5ElS9CioYesL zX0US6_JLOk68E

http://www.towernewlaboratory.com/uhH3Xk_ubUxkXMOhQr x_N b0 EkM1zfFDXduhwmE N6gOMKO6DwK87_JzrQvqhOgJCsH_6JaOiqp899vct4kooNeMFtl91uyRHz9q34n9FGkykv2R5JUcBk9vmqIFFplXBLhz _n2b3TMvMfbwzA5jHUXeag8qj ljVZgTUicCJAwc2WhpF2P5hlyRKONMLxF_zsuq9-G2AAAMTc2vM3cejvJXKozgp6jLko8oCLD lESikmbYIbsOFcxae7JlHzpqYaLbz6f3f413VYW45ImRjIxA8xRGDPRoIbERlc OhXqiSfAA==

http://install.zonastat.com/ZonaWebSetup.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.