home

kaspijskij-gruz-feat.-guf-vse-za-1-dollar-get-tune.net.mp3.exe

Mayris Corporation

The application kaspijskij-gruz-feat.-guf-vse-za-1-dollar-get-tune.net.mp3.exe by Mayris has been detected as a potentially unwanted program by 16 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from traffic-way.ru.
Publisher:
Mayris Corporation  (signed and verified)

Version:
1.2.10.0

MD5:
299b026e751d9826f89432c4bd8e18d2

SHA-1:
46f06be7fab5395f71098a2d5c9ffad01c26b8ac

SHA-256:
0af471b499f5cf7cab0d584b263d60ec55c6a4224a6ffed42a74b7bc96df98f8

Scanner detections:
16 / 68

Status:
Potentially unwanted

Analysis date:
1/14/2025 12:10:22 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Graftor.163346
5823642

avast!
Win32:Trojan-gen
141119-1

Bitdefender
Gen:Variant.Graftor.163346
1.0.20.1630

Dr.Web
Trojan.Zadved.8
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Graftor.163346
9.0.0.4570

ESET NOD32
Win32/Dlhelper.A potentially unwanted application
7.0.302.0

F-Prot
W32/A-a2fcb080
v6.4.7.1.166

F-Secure
Gen:Variant.Graftor.163346
11.2014-22-11_7

G Data
Gen:Variant.Graftor.163346
14.11.24

IKARUS anti.virus
PUA.Dlhelper
t3scan.1.8.3.0

K7 AntiVirus
Unwanted-Program
13.185.14098

MicroWorld eScan
Gen:Variant.Graftor.163346
15.0.0.978

NANO AntiVirus
Trojan.Win32.Zadved.didsqa
0.28.6.63474

Reason Heuristics
PUP.Optional.MayrisCorporation.x
14.11.22.7

Sophos
DLHelper
4.98

VIPRE Antivirus
Threat.5064197
35010

File size:
1.2 MB (1,285,448 bytes)

Product version:
1.2.10.0

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\kaspijskij-gruz-feat.-guf-vse-za-1-dollar-get-tune.net.mp3.exe

Digital Signature
Signed by:
Mayris Corporation

Authority:
COMODO CA Limited

Valid from:
12/6/2013 5:00:00 AM

Valid to:
12/7/2014 4:59:59 AM

Subject:
CN=Mayris Corporation, OU=Development Department, O=Mayris Corporation, STREET="50th Street , Global Plaza Tower", STREET="16th Floor, Suite H", L=Panama City, S=Outside United States, PostalCode=0834, C=PA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
64877F8F62583B45754C6201ED08A920

File PE Metadata
Compilation timestamp:
11/4/2014 3:50:31 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:BKeo83kClbmgrh529hn5pUYcIJJKUic9gHYV1mpVrH8oUkL6fahyviJih:8JQNygrhSnHUYzJKUV1mfrH8oUkw+3J2

Entry address:
0x32FE00

Entry point:
60, BE, 00, E0, 60, 00, 8D, BE, 00, 30, DF, FF, C7, 87, 34, 1C, 29, 00, 44, 74, 0D, 9D, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:
1.1 MB (1,191,936 bytes)

The file kaspijskij-gruz-feat.-guf-vse-za-1-dollar-get-tune.net.mp3.exe has been seen being distributed by the following URL.

http://traffic-way.ru/234/0/0/.../MTExMjk7MDtodHRwOi8vc3RyZWFtLmdldC10dW5lLm5ldC9saXN0ZW4vMjA4MzY2MzE4LzE0NjMzMzg0Ni8xNDM4Njk0NDAyLzkxZTEyYjVlOTRkNzQ1NWEvS2FzcGlqc2tpal9HcnV6X2ZlYXQuX0d1Zl8tX1ZzZV96YV8xX2RvbGxhcl8oZ2V0LXR1bmUubmV0KS5tcDM7S2FzcGlqc2tpal9HcnV6X2ZlYXQuX0d1Zl8tX1ZzZV96YV8xX2RvbGxhcl8oZ2V0LXR1bmUubmV0KS5tcDM7NDs3OTIwMTQ4OzA7MDs,

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.