home

ip changer 8.60-10.90.exe

The application ip changer 8.60-10.90.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the Self-extracting archive installer, however the file is not signed with an authenticode signature from a trusted source. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from doc-08-30-docs.googleusercontent.com and multiple other hosts.
MD5:
3f3304acfc60abc72fad9c73b7fec135

SHA-1:
41695c840a0c639d81b8bdf54fbc695866a50d3b

Scanner detections:
8 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 11:30:30 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dropper.Gen
8.3.2.4

Comodo Security
TrojWare.Win32.Injector.AGAS
23732

ESET NOD32
Win32/PSW.Tibia.NIC (variant)
10.12713

Fortinet FortiGate
W32/Tibia.NIC!tr.pws
2/17/2016

IKARUS anti.virus
Trojan.Win32.PSW
t3scan.1.9.5.0

McAfee
Artemis!4505EC35DC42
5600.6487

Qihoo 360 Security
QVM41.1.Malware.Gen
1.0.0.1077

Zillya! Antivirus
Adware.Amonetize.Win32.14988
2.0.0.2560

File size:
519 KB (531,426 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Self-extracting archive

Common path:
C:\documents and settings\komputer\moje dokumenty\downloads\ip changer 8.60-10.90.exe

File PE Metadata
Compilation timestamp:
12/1/2013 9:08:23 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:gRWNcr8oxn81X5HfTdBvO/9MDhZjSwLWlP4AKGCh:DNBI81XR2WDhptQP4AhCh

Entry address:
0x1D728

Entry point:
E8, F0, 57, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 05, FD, FF, FF, C7, 06, E4, 81, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, E4, 81, 42, 00, E9, BA, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, E4, 81, 42, 00, E8, A7, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, D1, C9, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Code size:
149.5 KB (153,088 bytes)

The file ip changer 8.60-10.90.exe has been seen being distributed by the following 2 URLs.

https://doc-08-30-docs.googleusercontent.com/docs/securesc/j206kaocfrhq14aufg3ja6f28isf7cdf/4udo0prae1g73t2renbh21cqtkt7gsdk/1455660000000/05827974175841756776/.../0B483LkvUsYL5eGlOdTk4RFVoOFU?e=download&nonce=v8vvgurereucs&user=02356794871028256153&hash=qun9nmr8qq45cvv87nqs80n2jhg1tjsg

https://docs.google.com/uc?authuser=0&id=0B483LkvUsYL5eGlOdTk4RFVoOFU&export=download

Remove ip changer 8.60-10.90.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.