mastodon_once_more_round_the_sun_direct.exe

VASSANA KONGSOONGNERN

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application mastodon_once_more_round_the_sun_direct.exe by VASSANA KONGSOONGNERN has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities.
Publisher:
VASSANA KONGSOONGNERN  (signed and verified)

MD5:
3bc44099767fdfffd9931b2dd705a65b

SHA-1:
dae6a18fff7597f802f6b8787c07cb58c64b0dc9

SHA-256:
37e086a8798672558c021549f622cede4e7da5e91d242130b7a41c692ad85738

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/24/2024 8:44:14 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen
7.11.200.132

AVG
Generic
2016.0.3231

Dr.Web
Adware.Yontoo.54
9.0.1.012

ESET NOD32
Win32/Adware.1ClickDownload.AJ
9.11002

K7 AntiVirus
Adware
13.191.14617

NANO AntiVirus
Trojan.Nsis.Yotoon.deckrr
0.30.0.64448

Reason Heuristics
PUP.VASSANAKONGSOONGNERN.h
15.1.12.21

Sophos
CoolMirage
4.98

VIPRE Antivirus
CoolMirage Ltd
36598

File size:
473 KB (484,368 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\mastodon_once_more_round_the_sun_direct.exe

Digital Signature
Authority:
Thawte, Inc.

Valid from:
10/6/2014 1:00:00 PM

Valid to:
10/7/2015 12:59:59 PM

Subject:
CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata
Compilation timestamp:
12/6/2009 11:50:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:SWCBVyqlMP1EgQxrtHT7df+WAvVxlXcE8Mt/t8THMwquGX+S:SlnDRxpHT70WA5wMtluswgXd

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9435

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file mastodon_once_more_round_the_sun_direct.exe has been seen being distributed by the following 42 URLs.

http://www.downloadallhere.com/file_ch.php?build=ttv_setup&filename=El_Nio.&rand=dYbRDTjtnV9IaOBRqzF5jkHJSKpHqdTEc4vQXPjlKt3VhFNIetNxOvhGgGnGUhl7lQYjFiEqLIm3n9MBDA8r5q7m7v31Mo98f7rVp6mbOIebS0NvAWWGm43tz6vmvEuKMWFc21nQKB2CCP7dL4T78WAI364yKyixuYJwZ7nJJpmleuzZys7HpHptOu1y3k6xiQ4iXs1GRo25SB5r4c8tUyWI2Yh5ioDBeITbaVS2jU8cvdDAqM3lk03nZlthJ6TYPM90I222WaesoR2OD69Y7dl6zOnjVghL3rLLtNOpX2SlTVax1kv8yQe7FCqBTImX97JCUx2SzVetQp0RJv0imfp2RQDLyZIH7rj2YmUyh917z1Zix0BUf0W7RzSpzB7G3rI2NDA4NCcmEcFbcg6sh2z8Csxc3FT76C9TgKY3mbq0n5cAmi2DlBLY3ja7Y3f4FoYV9WZv8pwvuI5Q17umJfkNzvVyyaCezBaIyadGzKc4shVtppQ9FbWfGRNf1qtA1EjzPwgohstJKpdaP4juffKV7xa9XEKZj3z8APxRh0B1pObeTvJ8Ku3S1e1ZSMZcPykqnRiERTGhISwBngJ8KN0M12MUOL6Ejr5Ginlag1sZTZAgfkoZ8pM9ry4gjbVCD0iVnE6EFzDzyePNzeNHDzR47Wlq7g3KgmGE0NiFmWeUb4IKivsV5j0cflDnCG8S2Pw2CPIZLXUX1DHk8agethqJD47fKf7N5EPItyHfvCcxfUSo48Cyp3i27piSFqFL4vty3bOzN162VYq072zw6RzdhS5XiLIngcVjnJSaKZcGYDH5GgBM8b0q46omR7J7jFrGpjQaj3QhHymnPYaXaaoegMA7UkfdZGToZKyiOpAvXWTMU3K4d9iuWTBQdQ3cwXBwIaPwAp2ylVkgZ5kceDG

http://www.downloadallhere.com/file_ch.php?build=ttv_setup&filename=Orange_is_the_new_black_season_1_complete_480p_hdtv_x264_[multi-sub]_[dexzaery]

http://tornnow.com/.../unibomber2.php?pub=ap702488&file=aHR0cDovL3d3dy50b3JyZW50aG91bmQuY29tL3RvcnJlbnQvZDY1OTc1OWJkYjM1MDFmZWZiMTdjYjg4NjM1YzMwMTMzOTM3ZGZjNw==&name=Z PYNA - Qbf Abpurf ra ry Cevpr 2014&fall=1

http://www.downloadallhere.com/file_ch.php?build=ttv_setup&filename=18_Sex_Tape_2014_UNCENSORED_English_Movies_Cam_AAC_New_with_Sample_rDX_

Latest 30 of 42 download URLs

Remove mastodon_once_more_round_the_sun_direct.exe - Powered by Reason Core Security