home

minecraft.exe

File

DaILY apps forfor

The application minecraft.exe by DaILY apps forfor has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from getr.0120j.info.
Publisher:
DaILY apps forfor  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
52b3275eba5f8921d23c033103528ee0

SHA-1:
3926a18607a19dfb30e6c46097564e885e4f2266

SHA-256:
e3930f9b89f026c70fc19ac8e012ca66425ffeabe63498024dc942065b3785c8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/24/2024 2:28:01 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Outbrowse.DaILYappsforfor (M)
15.8.17.4

File size:
1.1 MB (1,101,888 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015Apr20-010339-2422f65b-8524-496c-be91-8e14b18c4ea7.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
DaILY apps forfor

Authority:
thawte, Inc.

Valid from:
4/15/2015 5:00:00 PM

Valid to:
1/27/2016 3:59:59 PM

Subject:
CN=DaILY apps forfor, O=DaILY apps forfor, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
7368E6224D6DBF420C4EDAA69832A6EA

File PE Metadata
Compilation timestamp:
4/19/2015 6:03:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:fbSaE4mvt/AOf/VkcTH7Utrd0A0BasmYM:fbSv4mviq/N77sB0BTmYM

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5480

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file minecraft.exe has been seen being distributed by the following URL.

http://getr.0120j.info/1429491820/1429491820/.../azosLzAgXDc4MjktI2Q7NS0rMiVoPSwjaHBrXm1dc2hhaGI1ZG5fXSdjaXdpaWdfYG1rKGJpbSFhKTstIFwsPCsmXzA1LyJeLDcwIGQwOikzLCotLSVNPSwyKC4xLSUvNC00MC0uMjUtKl0yIGVzYm1waDdgbnNqcyAwWSMuYB0sZW0zKV5lX3ZpZlt2bS5ebGUjLmBFY21fY21eXnIqPmdxbWZvXGEdMGJmWW9tXWhgbx0wYkdhaGRdclxjbCxhcl0gY3NuXGphYWpbZV88R2lpYltwXWBsIGVjbGBrWWthN0VjbV9jbV5eciJjW2ltNzIhd2FuOSw

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.