» mp.exe
Overview
Analysis
File Details
Programs (1)
Downloads (1)

mp.exe

Discovery App

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application mp.exe by Discovery App has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. This file is typically installed with the program More Results Hub by Yontoo Technology, Inc. which is a potentially unwanted software program. The file has been seen being downloaded from cdn.moreresultshub.com.

File name:

mp.exe

Publisher:

Discovery App (signed and verified)

Version:

1.0.5660.17469

MD5:

025b308912b243cd3812aa043d879bf7

SHA-1:

18d2ede00476cd0685a5cfdb82bc0f920aa69bb3

SHA-256:

e3e4a897478653158cc9f439fcd7a44b778f306173a1ea8dce0d88055f9baea4

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Belongs to the Sambreel/Yontoo progam that inserts various forms of advertising in the user's web browser, installed with minimal or no user consent.

Analysis date:

11/24/2024 8:51:53 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Yontoo.DiscoveryApp (M)

15.7.14.12

File size:

29.2 KB (29,944 bytes)

Product version:

1.0.5660.17469

Original file name:

Output.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\local\temporary internet files\content.ie5\{random}\mp.exe

Digital Signature

Signed by:

Discovery App

Authority:

VeriSign, Inc.

Valid from:

3/24/2015 9:00:00 PM

Valid to:

3/24/2016 8:59:59 PM

Subject:

CN=Discovery App, O=Discovery App, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

510E3F5ACE52C22C76DC87DB7D1FCCE8

File PE Metadata

Compilation timestamp:

7/1/2015 2:42:18 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

384:x2PC5qda7QzX8BNrs/k1jwX3ybBbjjjh86FVqnYQDlSRgIFH6O5OdzsagfgnYPLn:x0exkzXOy/kRwX3EBb3mIAnlvlFgfgC

Entry address:

0x71EE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, 38, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 50, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 68, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

20.5 KB (20,992 bytes)

The file mp.exe has been discovered within the following program.

More Results Hub by Yontoo Technology, Inc.

www.moreresultshub.com/support

88% remove it

The file mp.exe has been seen being distributed by the following URL.

http://cdn.moreresultshub.com/.../mp?mpt=8&v=1.0.5660.17469

Remove mp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.