home

hikarahikaru cheat ayodance 6119 presskey cfs pf.exe

File

ClIck TRuSt oPT

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application hikarahikaru cheat ayodance 6119 presskey cfs pf.exe by ClIck TRuSt oPT has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the OutBrowse Revenyou installer. The file has been seen being downloaded from get.0118d.info.
Publisher:
ClIck TRuSt oPT  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
a33169a4d49c42262ba925c1d0970825

SHA-1:
3670e326482a0de2d5923cfc89885a8358ca505b

SHA-256:
1aec3667b931a08b4f2885c4b95d739f002e2473a182e28cbbf273158a69a55d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 5:53:58 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Outbrowse (M)
16.7.16.1

File size:
1.1 MB (1,102,424 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015Apr29-171131-90f4d862-6575-4294-8cf6-96daf3f5f4e2.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\hikarahikaru cheat ayodance 6119 presskey cfs pf.exe

Digital Signature
Signed by:
ClIck TRuSt oPT

Authority:
thawte, Inc.

Valid from:
4/26/2015 7:00:00 AM

Valid to:
1/28/2016 6:59:59 AM

Subject:
CN=ClIck TRuSt oPT, O=ClIck TRuSt oPT, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
542C498EAE7D7639BCA1973F6AD9A196

File PE Metadata
Compilation timestamp:
4/30/2015 12:11:31 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:DbSaE4mvt/rNro2Qfiii9Bs6c4AXMm3jNus:DbSv4mvRm2Qfin86c4AcajNT

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5489

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file hikarahikaru cheat ayodance 6119 presskey cfs pf.exe has been seen being distributed by the following URL.

http://get.0118d.info/.../1430327486/1430327486?36893755207ZF9sLDU4azgvMDIxIFw0LjI0LTcmZTorMSc2LSFpOzEfbWxnW3Jcb2lfbV46O2Zgd1ppP213Z2lpWVtKWmlcZWVrI19wXHJrZzhmdG1tHytYIithIDBmWmtjclhrJ15qayUrY15nbmtlalxiZmJpXx0pY2FfXm1kXmAsHSljQT8mQU89Qj0jSmJtcGssZXFiIFxwa1poZGFuWmpfNT9mZFxtX2hiaFtqbCg8Y2BfdCQ c2dbXmdeYCk2Ki4zI0dvXm5uaWVyKD0 SigkJktEJl9mZl1lXmZgOEZpZF5sWV9mZFxtcys8ZV9Zayg6dGpiYWdgXyMtLio0Jk5yXnBtY1x2JD5BUSskKEo HXFycG1qPWFxbmgcMFogLWQlK2NbZG5ecm4obmFrcF9qJXVydSAwZlprHytdbh4uX0JvcGtmZ1hhRlxpX2debyBLNDMxLTMkaVxsaDUpI3Nkazsy

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.