home

l6lgiy7w.exe

Vkontakte DJ Installer

RECORD LLC

The file l6lgiy7w.exe by RECORD has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from m.freemp3now.net and multiple other hosts.
Publisher:
RECORD LLC  (signed and verified)

Product:
Vkontakte DJ Installer

Version:
1.9.2.0

MD5:
d3f14a69d51a5c51520c2ea04782f2c6

SHA-1:
7d22120083362bff821b8c9582c977c36c92938f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
1/9/2025 6:00:22 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.RECORD.Installer (M)
16.2.12.10

File size:
592.7 KB (606,904 bytes)

Product version:
1.9.2.0

Copyright:
Copyright © 2015

Original file name:
DjLoader.exe

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\Local settings\temp\l6lgiy7w.exe.part

Digital Signature
Signed by:
RECORD LLC

Authority:
COMODO CA Limited

Valid from:
2/17/2015 2:00:00 AM

Valid to:
2/17/2018 1:59:59 AM

Subject:
CN=RECORD LLC, O=RECORD LLC, STREET="Kolomyazhsky 33, liter A", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=197341, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
58EE01AAB8D97EDC88B98056655D1841

File PE Metadata
Compilation timestamp:
2/5/2016 2:21:13 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:fpHBtFI4P7qsKQ0jnAt4BknkA3F2n3AymKMISPSgBtFi:BHJI4DBKQ0jnpBknk623WKMISP7Ji

Entry address:
0x7011E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.6524

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
440.5 KB (451,072 bytes)

The file l6lgiy7w.exe has been seen being distributed by the following 17 URLs.

http://m.freemp3now.net/4.html?group=530_1_link&name=OBERSCHLESIEN robot - Bez pradu - live HD Lochy Drakkara Tarnowskie Góry

http://music-loader.us/.../ZWMwMDAxMDBiNDAwMDNlYzAwMDAwNDAwMDAwNDAwMDAwNDAwOTYwNzYzZTE0ZQ==?name=Michael Learns to Rock - Actor.mp3

http://m.rappro.ru/4.html?group=530_1_link&name=????? ??? ???? - ???????? ?????

http://m.mp3-4-all.info/4.html?group=530_1_link&name=By NaMiD - Erkin osmanli - ayrildiq eng www tac az

http://m.freemp3now.net/4.html?group=530_1_link&name=Ion si Doina Aldea-Teodorovici - Ala bala portocala

http://m.toreadorrecords.com/4.html?group=530_1_link&name= ???????? ???? ???, ? ???????, ?????? ????? - ??????? ?????????? mp3 ????? ??????????? > toreadorrecords.com

http://m.4musics.org/4.html?group=530_1_link&name=Michael Jackson - Blood Is On The Dance Floor (Tom Teknik Bootleg)

http://m.mp3parade.ru/4.html?group=530_1_link&name=????? - ?? ???????? ?? ?? ????????(???????)

http://music-loader.us/.../ZWMwMDAxMDBiNDAwMDNlYzAwMDAwNDAwMDAwNDAwMDAwNDAwOTYwNzYzZTE0ZQ==?name=Bushido - Immer noch Feat. Baba Saad.mp3

http://m.freemp3now.net/4.html?group=530_1_link&name=???????? - ??? ????? ????? ??????

http://m.4musics.org/4.html?group=530_1_link&name="minecraft - ??????-????? super ??????? ??????? ! ???????? ?? ????? LPS music video" ????????? ???

http://m.ipoisk.org/4.html?group=530_1_link&name=SwagFox - Smoking Town [BASSBOOSTED]

http://m.wasbur.com/4.html?group=530_1_link&name=?????? ?????? - ????

http://m.freemp3now.net/4.html?group=530_1_link&name=Arzu ?????? ??????? - ????, ?????, ???? ????

http://m.ipoisk.org/4.html?group=530_1_link&name=Hosila Rahimova - Roksana ?????? ???????? - ??????

http://m.freemp3now.net/4.html?group=530_1_link&name=???????, ???????? - ??????

http://m.rappro.ru/4.html?group=530_1_link&name=James Blake - Our Love Comes Back

Remove l6lgiy7w.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.