» mediaget_id2582134ids1s.exe
Overview
Analysis
File Details
Downloads (26)

mediaget_id2582134ids1s.exe

mediaget-installer Module

Banner LLC

The application mediaget_id2582134ids1s.exe, “MediaGet installer” by Banner has been detected as a potentially unwanted program by 14 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from sub2.bubblesmedia.ru and multiple other hosts.

File name:

Publisher:

MediaGet LLC (signed by Banner LLC)

Product:

mediaget-installer Module

Description:

MediaGet installer

Version:

1.0

MD5:

20e60e425ad53668d7977083d6a6723f

SHA-1:

eefa12b6470c5429374e1d48b70b269edc18c0f0

SHA-256:

dbbb4abbffb56a8d1107ba71d2202d751bed8eb874fd88406c6fcb1397b079e1

Scanner detections:

14 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 9:53:11 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

PUA/MediaGet.Gen5

7.11.218.148

AVG

Banne

2016.0.3165

Baidu Antivirus

Adware.Win32.MediaGet

4.0.3.15319

Comodo Security

Application.Win32.MediaGet.G

21466

ESET NOD32

Win32/MediaGet.AF potentially unwanted (variant)

9.11347

Fortinet FortiGate

Riskware/MediaGet

3/19/2015

G Data

Win32.Adware.MediaGet

15.3.25

K7 AntiVirus

Unwanted-Program

13.202.15316

Kaspersky

not-a-virus:Downloader.Win32.MediaGet

14.0.0.2321

Malwarebytes

PUP.Adware.MediaGet

v2015.03.19.08

McAfee

Artemis!20E60E425AD5

5600.6821

Reason Heuristics

Optional.MediaGetApp.Installer

15.3.19.20

Sophos

MediaGet

4.98

Trend Micro House Call

Suspicious_GEN.F47V0319

7.2.78

File size:

633 KB (648,224 bytes)

Product version:

1.0

Original file name:

mediaget-installer.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\mediaget_id2582134ids1s.exe

Digital Signature

Signed by:

Banner LLC

Authority:

COMODO CA Limited

Valid from:

3/26/2014 2:00:00 AM

Valid to:

3/26/2017 1:59:59 AM

Subject:

CN=Banner LLC, O=Banner LLC, STREET="lit.A, pom. 7N, 21 Serebristy bul.", L=St.Petersburg, S=Russia, PostalCode=197341, C=RU

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

75D61BEBB47652BF2C5DF2DDF44F0E3A

File PE Metadata

Compilation timestamp:

3/19/2015 3:28:31 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:4heVLTaBt0aTBIczF8Z26kXBp8ERDEYOjyLuHHKF39NetsmK9f7l:4h2naBaGBIcpXxp8ERYYTLuHqFSsmcDl

Entry address:

0x14C0E0

Entry point:

60, BE, 00, 80, 50, 00, 8D, BE, 00, 90, EF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

276 KB (282,624 bytes)

The file mediaget_id2582134ids1s.exe has been seen being distributed by the following 26 URLs.

http://sub2.bubblesmedia.ru/go/?link=tQ/JW u0uKfe6QhJY8RZkCVuTGCpt1QsQkwCbFu5C3Iq1IP6p7ysB nmSyF7rm6Cl8vNTmd1 cJtIaftpl1abdrWfF28/U4KD5CYQ6a V47jFyDxlJITWBK10 rcqGzzpymx9c2Rp2P82YU=&param=eqgrRnEOVbk=&rid=2089&s=??????? ????? ???????? / Biutiful (2011) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&r=fast-torrent.ru&f=??????? ????? ???????? / Biutiful (2011) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&cs=utf-8&u=&fu=http://www.fast-torrent.ru/download/torrent/.../181414.torrent&cc=1

http://sub2.bubblesmedia.ru/go/?link=hzWakbgFmhGNIAIxmh5nUPLONy49wf2rOLyRxEDmjgnhzhBpzc2wR a5HHlFKVGBJKGc//tTlfIe94ju6RDwVzDYzFuzc7IT5cdGYTbxyYm7qz7nvriNRm8n0gSS9AaWPnWdMvdXvdqK g==&param=v6YuQ4QshzQ=&rid=2779&s=????? "??????? ?????????? - ????????? ??????????" - ??????? ???? - ?????? ?????? - ??????? fb2 - ??????, ?????? - ??????.net&r=litmir.me&f=????? "??????? ?????????? - ????????? ??????????" - ??????? ???? - ?????? ?????? - ??????? fb2 - ??????, ?????? - ??????.net&cs=UTF-8&u=&fu=http://www.litmir.me/data/Book/0/135000/.../Spiridonova_Elena__Onassis_Aristotel__-_grecheskii_milliarder__Litmir.net_135864.fb2.zip&cc=1

http://sub2.bubblesmedia.ru/go/.../7bKb1nqoNy8znetBGys4pqf1YW6nc6KX2MgLKPv5SyCu&param=x4X8Lb7JFZY=&rid=1490&cc=1

http://sub2.bubblesmedia.ru/go/?link=UIpQMosnpgD7hjEvh5jfzbURdfXGyA dwQYuHXVtnzWT3VGhaYVNCewPmN YKy0Y1lmGeMyuGz3OQgX ZSDVqi3AeNWIfMjc9uIXbPR4YQ9qbmq0k5h3cwewEyUoPMOT6ATQjCOCgwxE0g==&param=Atqkk1cDj1U=&rid=1113&s=&r=manytorrents.net&f=??????? / Dracula Untold (2014) MP4&cs=UTF-8&u=http://manytorrents.net/.../0-0-0-25308-20

http://sub2.bubblesmedia.ru/sb/clk/s/1246/o/145/p/1249/.../zsr?a=1

http://mediaget.com/torrent.php?r=saglamindir.net&u=http://www.saglamindir.net/.../Nr7.torrent&f=Setup

http://sub2.admitlead.ru/sb/clk/s/250/h/5bd7cb/o/471/.../gamerpc?a=1&auto=1

http://sub2.admitlead.ru/sb/clk/s/528/h/2b01f6/o/471/.../0?a=1

http://sub2.bubblesmedia.ru/go/?link=9GhmST4I3qYAsYxe4VwLhP/j4lVfuDzIu/.../msaljyXxR41IJum0 tZqYhB2X5RhU7uD9YMpjmvqTjJYAsu5qi92qlx68 l XEe4ejRcjitvwS8cKFN9WeiWDY2Bm69APPWVrUugdd bqEYenq0HsJWZHlSrCJ&param=xSY6BeS Fzc=&rid=2840&f=??????? ????????? ???? ??? ??????? ?????? 2. ?????? ???????? ?????? ?????? ?? ??????? ?????. ???? ???? ??? ??????? ?????? 2. ?????? ???????? ??????? ????????? ? ??????, ??????, ?????? ??? ??????????

http://mediaget.com/torrent.php?r=pc-torrents.com&u=http://pc-torrents.com/.../download.php?id=461

http://sub2.bubblesmedia.ru/sb/clk/s/125/o/145/.../0?a=1

http://ld.mediaget.com/index3.php?reinstall=true&bbls_client_id=154757332

http://media-get.ru/torrent.php?cs=windows-1251&r=pslancom&s=Armada Music Videos (Official Video) (2009-2014) 720p, 1080p HDTVRip&f=pslan.com.Armada Music Videos (Official Video) (2009-2014) 720p, 1080p HDTVRip

http://go.xetcom.com/.../index.php

http://mediaget.com/download.php?ref_id=yandex&os=windows

http://sub2.bubblesmedia.ru/sb/clk/s/1615/o/145/.../0?a=1

http://sub2.bubblesmedia.ru/sb/clk/s/1615/h/b71cf6/o/145/.../0?a=1

http://li.ru/.../torr.php?r=hotcharts.ru

http://sub2.bubblesmedia.ru/sb/clk/s/1038/h/90d092/o/145/p/2102/.../0?a=1

http://sub2.bubblesmedia.ru/go/?link= qszBnGLZhtwODy97qaIXn1AtjP7 R7/efMYQnrm17nJpiBjOOZjNwcRyr9amIsilQPs43vjrNiIE8nWexl6zzig5ejI A4jBrjtEkiGqOE2ANF2ZYmPx9Nh1QMcjv6i9K6TNO8/t9hpnA==&param=luxLp4bVSm8=&rid=1962&s=?????? ?????????? ?????? (2015) ???????? ??? ????? /.../ ?????? ?????? ????????? ????? ?????? 1-20 ????? - ? - ??????? ?? ?????? ?????? - ??????? ?? ?????? 2014 ? HD ??????&cs=UTF-8&u=&fu=&cc=1

http://ld.mediaget.com/index2.php?l=ru&r=rutor.org.ua&bbls_client_id=155511896&bbl=1&bbl_clk_id=330222-1427027486

http://sub2.bubblesmedia.ru/go/?link=1HapyeDSB2TAfQ2FLl/u BWVBUvkq2dWeL5KJotaBMKYz1W5Cxyp3rVaVeeZ7ehSciCzBtEU8LXfyK82fn9JEv0GD8ICcpCO5M txxa8i0LSn7YxQ6XziX0yyCf7obDQd0VTE3RUuw5mTjU=&param=0brKe9ET/bs=&rid=2089&s=??????? ?????? ?? ??? ?????? ????? 1,2,3,4,5 / Breaking Bad (2008) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&r=fast-torrent.ru&f=??????? ?????? ?? ??? ?????? ????? 1,2,3,4,5 / Breaking Bad (2008) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&cs=utf-8&u=&fu=http://www.fast-torrent.ru/download/torrent/.../undefined.torrent&cc=1

http://sub2.bubblesmedia.ru/go/.../iGATZZ03xoGO2kh78NeqHVX9HEpapTuXuzaR9VVAy0lh1ZLtVQvtG8AGXFFF0wzeDSE=&param=07V33BNs6kU=&rid=1144&s=&r=p-games.ru&f=&cs=windows-1251&u=&cc=2

http://ld.mediaget.com/index2.php?l=ru&r=torgames.net&f=u0421u043au0430u0447u0430u0442u044c-u0438u0433u0440u0443-the-sims-4-2014-u043du0430-pc-u0431u0435u0441u043fu043bu0430u0442u043du043e-u0447u0435u0440u0435u0437-u0442u043eu0440u0440u0435u043du0442&s=???????-????-The-Sims-4-(2014)-??-PC-?????????-?????-???????&bbls_client_id=156233290&bbl=1&bbl_clk_id=141209-1427185956

http://sub2.bubblesmedia.ru/sb/clk/s/1923/o/145/.../0?a=1

http://mediaget.com/download.php?ref_id=google&os=windows

Remove mediaget_id2582134ids1s.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.