home

gta_v.exe

Cilap

Morava Group

The application gta_v.exe, “Cilap Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsfilessafe.com and multiple other hosts.
Publisher:
Morava Group  (signed and verified)

Product:
Cilap

Description:
Cilap Setup

MD5:
b9106239a9e85301ed5e6c4026636917

SHA-1:
4dfb0d4a74d1016b747df878dbc3e22052725260

SHA-256:
20c06fda2792eea7f30c987f2b1511f227b2c8974e7821958a4de01b981da9d7

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 2:53:15 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.5.14.7

File size:
925.9 KB (948,152 bytes)

Product version:
3.7.3

Copyright:
Fast Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\gta_v.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 3:28:01 AM

Valid to:
3/8/2017 3:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0H9a0YfN12k11Me/htysP9NLE/MJmPh6L:QRYfN124yghtJDLyMJmh6L

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9339

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file gta_v.exe has been seen being distributed by the following 11 URLs.

http://www.appsfilessafe.com/WVl6OTRQWGRYZVhneFlUZENRbmdsTWtKdGFGTmtWSFJSUVZsUlRWaHpXa2hzTUd4Qk5tVkplQ1V5UW1oRWQzTjRWVWhWSlRORUptTTlRVE5JVEZSQk5tMXVXVEozVWxKM2VYaDNhRFpvUlV4MlFWWkZiVTlzZDNkSVkwTXhVRGxFUkdSbFF5VXlRbEJrYkVoTU1VaDROMncwV1ZwQ1F6ZG5hMGdsTWtZNFJVSktiVzVNU1dVNFpVbGpWVEYxUm14V1JsZ3lSMEY1YVRFd1RUaHRKVEpDY2xCaVRVTm1iV1JFUm00MGRtdEllRlJGU0daTVdqTmpVbU5OZGtWa1MydEpZblUwTVVsVEpUSkNKVEpHY1V4TlQzaHdiVWhvVXpSTWR5VXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFIVkVGZlZpNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BVWmhiR3hpWVdOcksxVlNUQT09

http://www.appsfilessafe.com/.../bLw0hDXk01adlcf16xsHfhyD t0esIRQpcPDSDd9fM=&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=8QGWRF DK2m7GvxTI6otkXx4npYCOI/eQhWkJybYLbA=&c=nEVGpb xyefWvl7SsEV/wPcGyQesOesc4A6vo6diAW72MSBcSRHWQpFfMIiFX833w0pwqzD2o4WytfQu4V627FmfGTZ/.../jJlj1xpOshFx0YqldePzod&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/.../0YebAxJDzT5A90wqrj1P18aSpCzxgqmsqNuTB7W lnxfGZ3M&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=NEX8EU0w63UX0PvWo9a04hFqm102kAZd91tk3 8cb5U=&c=nIFawH/49goYJne 5mIMiWQ8grpdpsg05rgV8F/rq5CGEKaVqGG9CSymRVH9mklR3QMtEgyq2AEHEvTFvby0RD6 B/.../37SxD6yKE8GXYJeyMdXkvkF8IG 9Ya1CgvtdSubvTOZjxsMZVrhSowzVF&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=hp BcT81OelYSmmM/.../oNCTaJUR1kPm4dGPSZYxAOeoHW nUhZZ2z72MQ2Ft0u2e9v0NnSBF5vDLWMJgK5RQrnJXfqrj2l0uugL 8mslDju3k2&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=gWStYJg/nYO9W0O3W05z0OEUXa8VZKq1GR88TxOi16w=&c=HE f/yUSVsHHQh4jOnPk9fGIW3P2azIaeplPvuqG5P1Zn/MGB8S6J7uoUsyOOtx/XTZBuZzRyKbR04t4 tZpHZZxiADxKl HQivsNLNay7Ug4QsbXGLMn/.../C2N2Fh4Zwhu9iZiVv0RfQb8cv6TnNiYQPSfENsvtrV177s BJWhO3bkmD8wDzpEPD&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=q IJZHs5AbHmbh 2JS2f5PwvH3t6EmPenTjLPXtzVPk=&c=iCdkmI6V9FeNdU5Ty4ntnb9KsosBtP6OJcJaceo/.../BHO 2nhPyrPJRAKhQFvjknsUDuK491Hd6DcGmiz A9EsEJ6S0A7Y 9Pf2D9fxjbe5W8PB9CZ02wYwlt4&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=a/LysYUUslNYTrRas4bTrX7InQM0vHWEXySS6mveFig=&c=cNKXOA/OH1oBKrQu3bjcu9Ad5Z khkF4WF iopeHkdOZnMvGn6sPbs/a3Giht0PHieZOxVwn7YuPUvqR2KtAU5qaRZtb2QToJkTopoJ stJtSYdtEmP7uM4Oo/kOy30/.../Hn6YFo6CBm86mdJgWjnFRiDbPIQ=&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=R2eyVD4sA9mePI13HiXteVxII1WWa3at4wEazUa6KQA=&c=cl2LEkGd1on7YBZs4/f4yeQA8ohaiE0DwQWQI3JU9aIE7UE7caze5rK8EaAMeQCBWqMYKhqkTvr8Z /go8vfKeo46X7dw6GwXIW5APU1vOoIIe6Bi/n Ft c0mxJrUAsKbdzyV02ynskthmR8DWT8NmQV1I1Fr0FV11/.../ zU&e=0&downloadAs=GTA_V.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=Rn ivJ/.../5C317FU0xunKewGIUP1tIZWgao9 vzit0XU7yKg9PjPAqPkKBJjf7tABvB2Z tNtNMFsJN08ENKo1sjjY2DXC8dE&downloadAs=GTA_V.exe&fallback_url=Fallback URL

Remove gta_v.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.