home

MediaDrug.exe

MediaDrug

The application MediaDrug.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program MediaDrug. While running, it connects to the Internet address lab.mn on port 80 using the HTTP protocol.
Publisher:
MediaDrug

Product:
MediaDrug

Version:
1.6.0.0

MD5:
f4ecd603fdc46089918787be0262804e

SHA-1:
86632dddaa95cd783d35dcd9d27efa66f1906459

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 6:54:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.MediaDrug.Meta
15.5.22.11

File size:
2.2 MB (2,283,520 bytes)

Product version:
1.6

Copyright:
Copyright © 2012 MediaDrug

Original file name:
MediaDrug.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\media drug\mediadrug\mediadrug.exe

File PE Metadata
Compilation timestamp:
12/21/2013 12:37:54 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
49152:yaMRwFmHbs7RnHFHrqX1YQ/NkvViyrVJ9nLobuX0R/ScLvuTMVCKQ:yaq6FHrEKEyrVJ9nWuXa/ScCgZQ

Entry address:
0x12A0

Entry point:
55, 89, E5, 83, EC, 08, C7, 04, 24, 02, 00, 00, 00, FF, 15, 5C, DA, 60, 00, E8, 98, FE, FF, FF, 90, 8D, B4, 26, 00, 00, 00, 00, 55, 8B, 0D, 9C, DA, 60, 00, 89, E5, 5D, FF, E1, 8D, 74, 26, 00, 55, 8B, 0D, 80, DA, 60, 00, 89, E5, 5D, FF, E1, 90, 90, 90, 90, 55, 89, E5, 83, EC, 18, C7, 04, 24, 00, B0, 54, 00, E8, 2A, 5A, 10, 00, 52, 85, C0, 74, 65, C7, 44, 24, 04, 13, B0, 54, 00, 89, 04, 24, E8, 1D, 5A, 10, 00, 83, EC, 08, 85, C0, 74, 11, C7, 44, 24, 04, 08, 40, 60, 00, C7, 04, 24, 20, 33, 5F, 00, FF, D0, 8B...
 
[+]

Packer / compiler:
MingWin32

Code size:
1.3 MB (1,324,544 bytes)

The file MediaDrug.exe has been discovered within the following programs.

MediaDrug  by MediaDrug
Publisher's description - “It has never been easier to download entire mp3 albums by your favorite artists! After hearing a great song play you may want to take a closer look at the artist's work and even download their whole album.”
mediadrug.com
About 6% of users remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to s2-db.nitralabs.com  (46.28.68.78:80)

TCP (HTTP):
Connects to lab.mn  (82.118.16.253:80)

Remove MediaDrug.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.