home

gtasnowedition.exe

GTA Snow Edition

NSIS

The application gtasnowedition.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup. The file has been seen being downloaded from gta-iv-san-andreas-snow-edition.ar.softonic.com and multiple other hosts.
Publisher:
NSIS

Product:
GTA Snow Edition

Version:
2.2

MD5:
dd6d6347817049c92ba128149f3bcea8

SHA-1:
097fc1fe484453f90aa563e92f0582ee6731fc56

SHA-256:
3fb915d1a8d63e73816acba8ba9319dcbc43ba78bd86f3122a94608db78579c0

Scanner detections:
6 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:
11/24/2024 10:51:43 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
NSIS:InstMonetizer-CA [PUP]
2014.9-160321

ESET NOD32
Win32/InstallMonetizer.AN potentially unwanted application
8.0.319.0

Kaspersky
not-a-virus:AdWare.Win32.InstallMonster
15.0.0.562

Microsoft Security Essentials
SoftwareBundler:Win32/Stallmonitz
1.1.12505.0

Qihoo 360 Security
HEUR/QVM42.0.0000.Malware.Gen
1.0.0.1120

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.4

File size:
1020.8 KB (1,045,315 bytes)

Product version:
2

Copyright:
NSIS

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\gtasnowedition.exe

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:iIEd3IlaFKUAaCREVwSgmz/nspQs5u1PxBw/BRw4laFKUAaCH:iIkcL9RCSo1PzwpRpL9H

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.8845

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file gtasnowedition.exe has been seen being distributed by the following 5 URLs.

http://gta-iv-san-andreas-snow-edition.ar.softonic.com/start-download/.../f495acd48f0ce3b23e7be691871df85c

http://gta-iv-san-andreas-snow-edition.ar.softonic.com/start-download/.../4f9ba0eb23764685cb2d1f7c71500e72

http://gtsnow.uploadtobox.com/GTASnowEdition.exe

http://gta-iv-san-andreas-snow-edition.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAMoF3ivMrAkL/ZLi7VITkrRsLghywZ8NbL9XFt9iqm/.../dPcpPb41OQBb4=

http://gsf-cf.softonic.com/097/fc1/.../GTASnowEdition.exe

Remove gtasnowedition.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.