home

minecraft.exe

Ginapaho

LAM Proactive And Investments Ltd

The application minecraft.exe, “Ginapaho Setup ” by LAM Proactive And Investments has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.newclearchuckle.com and multiple other hosts.
Publisher:
Nema   (signed by LAM Proactive And Investments Ltd)

Product:
Ginapaho

Description:
Ginapaho Setup

MD5:
5fb4df4eed4cd7d63151dcd3ac85c85e

SHA-1:
3384c77333bf5b0e6ddaf458a545c95438993de9

SHA-256:
d69e796618b2d13a6a8fda50174e1fe2e1018a9b1d445f7a03d0bfd0224f76c7

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/25/2024 10:45:41 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.LAMProac.Installer (M)
16.6.28.7

File size:
997.9 KB (1,021,824 bytes)

Product version:
4.7.4

Copyright:
Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Turkish (Turkey)

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
LAM Proactive And Investments Ltd

Authority:
GlobalSign nv-sa

Valid from:
5/10/2016 5:04:53 PM

Valid to:
5/11/2017 5:04:53 PM

Subject:
CN=LAM Proactive And Investments Ltd, O=LAM Proactive And Investments Ltd, L=Herzliya, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112169523491FA6C7A30991E1A2D83769865

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yiU5826hRPlUG7QNQpl92T5Vvw4s7OMxOrb1+8:7F2icNkDo/MA/E

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file minecraft.exe has been seen being distributed by the following 9 URLs.

http://www.newclearchuckle.com/QOCdxZTkPnG M7UB67PWlyUID5gsB0juDVSyY2YoWcTGlgfqddwXe2hM8pjWyXXMpgqGnT5Tg cpVr6gh6O WjR5qgmInbPZ iZWChfnC6FowDRRTbPHpUacNWFy8VsOWg1n fegLl1hD4AUIjh6HiGOElWn3Ub9VEtaUIK2OqyItPsnA0afiHdoiKIQ9zsa115TW_NS_H_RseORckrz SD4HGC_FBgyvK4u5pA4RDDuopNuKIOCgNmPQOobQPjNYrBHNkutXZyNUA6C2_9uGH5h4J4K7N8jfDnJD1Z56vIz6a0lVBsmy9fzwwjXEsSKxoEdOowFeUgrOyTe 5v0ymYf33nWdEQ7di_NQrVBRCC55_fW0bL4osjg acVyfbn_0ZECfOJG6CvOKFxcj7SYZDlJ4 nThE6TJ54 2m_P8zKE9FCiXuIOxvBfUNiecKm0p20D1oON_lQlrGyAjuZbtf5laVkvQWjA_xA2neRUQkyHJW6x8A=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/RIurM AusDCJqMl8Hbt5TpnIRc7GFU4Wuna8eUGpdhff65u6FW7EHHviWUIdGM0qV3GLdj6W6IzsBu5jB21q2nbBuf61TbmG05fyOTwNWaQNXxSJyUO7QKEwE5d7B1df9sCbcqPMO13SVkjgKneeJHpLLRAFNgtO5Z03dOWHD9D2VjychmlThw9ULyxkXjvLUh92k7KStiNLGXGULfuM7iUpXDpcPPK_hvrfOcu5IuIWWmGKZjDEaN4ZQE6lSZfhuiVnxkW6O8rrzZjC_4gttmGB vISZ Pc dB6 sY 88VffrDdNFnml203O7mkjiHTaSJm5jRLHoS0vGx5lTL3ha2tN_fti3B3SGFUZ69jjFgLexrfSYc35pkPZggbczOpanF6uFnxV 0JlymuzdUBG24SNvEYrMZeHZvMj6AsT_t5SRGMApe9Hi_LTVw8pceNtoKXpA02TcZIB6 iX8R2fj_Z35Csu_rE ZN5RmHt1qC8jmP07xM=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/weiJuOYsoYPt dJpgrX1phQwLIdCcEg_nyOCHVb6DeRnZeaKIVJRFg8ZNn5ubQk62pgFSjK8SnGry4CeQxBkrKCaOhHCtqQCXabpqHa413r356peBgkFkLi4VN 11K9tg0AxRXVUcsxnFWFAgz_5zqpAl0StjlITXnwzLN_UXjICCdZoVMmGiqIdwy54v7s1EWFD1PuKn6Aj1o CsCAX2wWSHkNqrnY1G2IVOsp80v7PaLA2PLoidGXgurTG1hNSzRH4SHmrQ2sqdu7hG_Y1Eg7HFxxW7LgVKAuShMHn0TSrzWKrXjR_Q2N Un3Don9F uCncnZgPaitvKkSBtDUNCz9rt2PyjDkNHvoTyE06k23gRIl F3cLNIDJ0ZqEKn_XVlMZHeQGIsl9uLMl92yuhdq2dKIMVhPJlmC lkx9R88kNS76tDKcHYO9gewH4Et2heDR1iz7N7uhQ41hIY3a9SThoFsIXGhSJqv9Ifb4RNZ805mAl4=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/Ip1F6TyM4O9Z1Z ibZ5cMNsOTVqqvVUc7zmFEv8Fdu2ebFXD68GmyqpevwkkAHkngGCjFb8c5qyZTRt78x_lTbeZCrP 26Nl 8XRRcBA1sMg4AiyRANXwKPg7yOn5J9VPh75WdKgny3_xMX9m2DQ_Aeq3wTBcPpVGrAryM8gfqr9PBDUckVnKDTEkteBMlJ_XnN2NZtsh555XLr1yecUltMOMOt6crk5xdaI0neoohkKNhcYJVZ_b40jQwCLejlf3rX2miuQOn QKGHvQfYDWiVSSg_XTI3KDp_DQF33ButgDqfbqO4BNf zxtr fP_fuOqM0JHRNM3 0KEuZp89EVbcsVSGfVtKRHtLAs9OFfGSBKFYvVQ9QqdJ67Gkk4Hc1rHGLAfg6R3tFlLch4XuE lO0zvbMKjtIiFCnALWY0biY7v2lh kYxCddgKQab4b8UaL0DgJBP2JjzkmwS R3KVY86H2Xwkzql_J 705COEwHfjK_0Q=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/ljkHCCN05RfNfCg542hBXUfSDFpfAiCdk_xtT7KIdjH6sxjhQtPsrAcD8iemY1ZCiJMNWveGs3URUHOp3jTjFdEvgliRp53mjDfaDRKm1Tb pS8YbkuGuykvPn_nwQvAQbllVp5_7wm2D0eeDo__Qn7mvJwItJlhKuVH8oMGwstYJTSsmhWYD8j2VXy6SltSji0e40qKh5YkGZh7AuLbHIhdHFO5R hrGut2aGoYT6kU1y2Cln_SM6m6CgVWCuRtkjj6MN82o3BET9OufMNZfs3HqMVw_G1_yFXRx48Dfgilcx02UfQFwilO2MSWbRTIVrnVWOhWMxLbHxXuorqR38wrXAx4rMCIqk1 jG7KbuGx_dZGLfm8fsrXGZCs7ZyRYAXqKYeVqE9KNqxpXBs2fmr4dMTkjjsr7f82mNeAcHJ88AkLmEDZppeK5jCAa erxhE9gq0CT_vItBpVfWeilAiFg3nsO8fJe5c5KkmDT_cdgQfDyfQ=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://minecraft.jetindir.com/.../?download

http://www.newclearchuckle.com/BOzPPQC 2QXO2fE8_ScoGUiOjoVTTW oxpjzM4h3jzwrFvxCIHTQ1HtMmNtjvoVWrCMKhEV2beQL4HtO_fAYMFdSvhFZ_rx2HuOPXyHu4EHgOPR7iYN9WOpTK4cyDY QZNAN4Yriy3E2bLyoxcCFz6uAwp8LdtlSSTzPB8DWdtvmbxGHZzl7i7F0wZKj6vk2lgH2SSLpLQmRRb31ZPaPThhgvBwrsjzTZIyn 7mqUsGXrphwHAZj5Wwgmkzjq2A_IwV8pqHmvPDO7rk24nQ0Uw1NJ0urKcCfK2kRSADRI4swXQH5h8Oorq8BlNZY6VSRp_CwiKIvjBf1q6in8sRaS3syhNVKWkjmqinpcTzEa0UvKCzsAEEJSiU0uYJa3LDO8WVg9AdNU7LZgneXuG3B6TFGqmPu7paeecf0at7bO0VM 6ZYQ5LU4lNeVhm6QmpUyQ9GzZbp1WX79PHspmXfp0cvOgnmSOWZg_zfWzjvzxXhTVU7GsU=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/rb1MMYpQ7o5ZsKqHYBqCJGXgyYQJoqKugzBwaw_bcfIXnx_bRPkUi6kM9ZslIjE0QMWTajoBXAzG9ilW LiU1zLHyM oyrlb3oYH8CyJR98bNPGKK7uTuy_B3AS2fK4830 Lw5ViCsbgZu6i77Mf0qtOCJDQGB1HY2w3qumv4snNLWa8JEvQ1jTETIA85SWH9M3U1rqdSifsgcRl9a9zI1fj2fi7ofxRuLndv6_d9PG Tp9m3N 0l_ri2BQLTLKoVaQDGi52EtfSeZM7eUsABPNJpWfvUHUUmmq8lW9yw8EnlN6RoBmGDUCKq_RhtxjdM2 u1nNkRtLgHlk_PT7Mt8OEjAvat7nZ4CJVaRWvCDUkEDEuuuh_TI_ptImNwUWaf42maL_D4zDW6FD8JxXR1CLaKOB5lnCgfgtpyaaF8mJGQeSkqVuU6GqcpvanbXXkL8FZppywfrDiysQXy3Y7fKWcJBHjxwgsG_WeYaqVrtrYZe5CEGM=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

http://www.newclearchuckle.com/kDPLzMUdDzxMOIW1sXMD 9KZKSIve9 XlgMZpyyqC_fCL8CcG2UXwjXoM094ttIdzaoSi29KJ1FBNgpcjJNVOFv3zpVHnwgijeDRBzkxVFXVB8t59luVGVHVm4zfWfSrxCwuDnn iX5ZF4tJpo7WNuiR9 Y5NIG2Yjn9ts8LlP 5cOshp_nzIfvi7bQisVc0zchNgGROZk3zxt76LnAFiIwEPUG s0jNCW42rVyPdd6xlB1RWq vr2qTMcchHpSNETA0leDuacGoAv_nX81Muh2McrNRjQUC0Ue8JiqTDDylMoRFS3ErUULsLaa_Z1_WXi_ih3 16a8ESuXJPF99snVSBcy4YsKlBQmjV4jsgFr8OtP5Nc5mqa55c3eypmvWy8dtHAk65FUzAuLNtPcl7G3OuyXMhKzcZFtPbuZ3BY_m v G8AqMdqTEOZ5btJuBbU4iYnRAjy7wb6AlNt8ga0UNj2nZXHK5WZxpJAUyXdVK8mkadd4=-G20AAETn1hoRQ2KmyBhTR0C3C045YK VfZ9H_gXAB7chePyCe6QvIk1jdOk6bBcXOLU yK_LeJ_AmF2p_zV8ScBIXCRIp8BGG5q4xzdmhQA=-e

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.