home

mery_mery_hemp_gru.mp3_downloader_pl_50.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application mery_mery_hemp_gru.mp3_downloader_pl_50.exe by Righway Technologies, Inc has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This file is typically installed with the program GoforFiles by Righway Technologies, Inc which is a potentially unwanted software program. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 464

MD5:
03df1349cb489d9cc24663458032636f

SHA-1:
d7bcf17e0169f4851ce662e398f562e145aed04d

SHA-256:
9f8ceabd3c347c5e11edb5b3336a3b26ff8d0e0e75bc50b4c5d8d86ebe0dbc13

Scanner detections:
9 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 12:43:24 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-140503

AVG
Skodna.Generic_c
2015.0.3486

ESET NOD32
Win32/YourFileDownloader (variant)
8.8633

K7 AntiVirus
Riskware
13.170.9144

McAfee
Artemis!03DF1349CB48
5600.7142

Reason Heuristics
PUP.RighwayTechnologies.g
14.8.7.21

Sophos
Go For Files
4.91

Trend Micro House Call
TROJ_GEN.F47V0607
7.2.123

VIPRE Antivirus
ExpressFiles Installer
20038

File size:
5 MB (5,276,296 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
6/7/2013 1:06:44 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:jT6g3fWRTrUn0wqsNhjtjGH5xJ4jfbYayg+3pxdbvHETOu5:v/OT4n0whBjGZxJ4jTYW+fdoTOw

Entry address:
0xE8D6

Entry point:
E8, DA, 7D, 00, 00, E9, 89, FE, FF, FF, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, BA, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 49, 1E, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 50, EA, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, 64, E9...
 
[+]

Code size:
112 KB (114,688 bytes)

The file mery_mery_hemp_gru.mp3_downloader_pl_50.exe has been discovered within the following program.

GoforFiles  by Righway Technologies, Inc
GoforFiles bundles various adware toolbars including the Delta Search Toolbar (an adware toolbar that modifies the user's web browser home page, search settings and other settings).
www.goforfiles.com
70% remove it
 
Powered by Should I Remove It?

The file mery_mery_hemp_gru.mp3_downloader_pl_50.exe has been seen being distributed by the following 11 URLs.

http://gogo.goforfiles.com/.../HimTP 4 zzPwP2l9tmI0KakpfUPkM2VBqlcgD 8VKRysXSwCkFkkAJM=

http://gogo.goforfiles.com/j5G2Qmybulpy3KRGa5O8ImbVrCY5obsocu wIGyhhHhto4swDL2ZaACgnmIb68ZQHujFVAvV3xxbjZlSDtg1VU2ZZwAvmW1Gc8Q=

http://gogo.goforfiles.com/.../QpmFms R6JfPofy7602Yp6pI6S7TUbxbgyyxfuoYOR7jIUQM=

http://gogo.goforfiles.com/j5GRX2ebnV5rxKFaIde3aErdoik0tKp2J/fqeyL/.../cMgT7mNZhLk2XlZrZMUQ7WRWgTY

http://gogo.goforfiles.com/.../YTQurSFpdOtnPBGneH9Q9RV9QP9bIR0=

http://gogo.goforfiles.com/.../9ZmFuDPLEu9iWIe6MVFXamXEF JnVYB3A==

http://gogo.goforfiles.com/j5GRVnDUoEgt5qRRbcy LWuSuDch5q04K/XueC7/0mAp/.../VyQ==

http://gogo.goforfiles.com/j5GWQ23erF8t/qhMf8v6aCX1uGxGqLxgW6uoIW6piD0154kuULmKKAi5nWwMrIJeH /.../I

http://gogo.goforfiles.com/j5GxX2ebulNn2ahRIcu3OmDE ypi8/8/.../oIWTKuYDlbdzFs=

http://gogo.goforfiles.com/j5GTfkbyhmMo8ZgZfsvscj2L5nQr9 59JeKqInOs3Gcu MMkV7KeNk w0GcT

http://gogo.goforfiles.com/j5GTfkbyhmMo8ZgZfdW4JzOI5XM0s6wpYam0Kyfw2HVqv9hmEefaahLt32sf

Remove mery_mery_hemp_gru.mp3_downloader_pl_50.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.