home

[mp3 dl] trespassing - adam lambert (mediafire hq).exe

WindowsFormsApplication2

RECORD LLC

The application [mp3 dl] trespassing - adam lambert (mediafire hq).exe by RECORD has been detected as adware by 21 anti-malware scanners. The file has been seen being downloaded from setup.pereday.ru and multiple other hosts.
Publisher:
RECORD LLC  (signed and verified)

Product:
WindowsFormsApplication2

Version:
1.0.0.0

MD5:
28f52dd6ee7d5485960dfe64ce1ff35d

SHA-1:
e735905dfc41beaa59a0b562598d59e9e8fc690e

SHA-256:
a58738b079b982f3caa7dd70e405677bd06ad6932761888e820b5e5ee7c6e8c5

Scanner detections:
21 / 68

Status:
Adware

Analysis date:
11/27/2024 7:36:37 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Downloader.207
595

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
TR/Dldr.Agent.241848.2
8.3.1.6

Arcabit
Trojan.Application.Downloader.207
1.0.0.425

AVG
AdInstaller.kontakte
2016.0.3073

Baidu Antivirus
PUA.MSIL.Agent
4.0.3.15620

Bitdefender
Gen:Variant.Application.Downloader.207
1.0.20.855

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Program.VKontakteDJ.1
9.0.1.0171

ESET NOD32
MSIL/Downloader.Agent.P potentially unwanted (variant)
9.11815

F-Secure
Gen:Variant.Application.Downloader
11.2015-20-06_7

G Data
Gen:Variant.Application.Downloader.207
15.6.25

IKARUS anti.virus
AdWare.AdInstaller
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.205.16308

McAfee
Artemis!28F52DD6EE7D
5600.6729

MicroWorld eScan
Gen:Variant.Application.Downloader.207
16.0.0.513

Qihoo 360 Security
Win32/Trojan.0f4
1.0.0.1015

Reason Heuristics
PUP.RECORD (M)
15.6.20.10

SUPERAntiSpyware
Adware.Kontakte/Variant
9802

Trend Micro House Call
Suspicious_GEN.F47V0617
7.2.171

VIPRE Antivirus
Trojan.Win32.Generic
41294

File size:
236.2 KB (241,848 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2014

Original file name:
VkdjDownloader.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\[mp3 dl] trespassing - adam lambert (mediafire hq).exe

Digital Signature
Signed by:
RECORD LLC

Authority:
COMODO CA Limited

Valid from:
2/17/2015 4:00:00 AM

Valid to:
2/17/2018 3:59:59 AM

Subject:
CN=RECORD LLC, O=RECORD LLC, STREET="Kolomyazhsky 33, liter A", L=Saint-Petersburg, S=Saint-Petersburg, PostalCode=197341, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
58EE01AAB8D97EDC88B98056655D1841

File PE Metadata
Compilation timestamp:
4/29/2015 9:50:30 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:QjaVJ9D3J2z9In3mPEJgykjDc3F2n/rq:QjmDU23mPmgj62/rq

Entry address:
0x3482E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.9975

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
202.5 KB (207,360 bytes)

The file [mp3 dl] trespassing - adam lambert (mediafire hq).exe has been seen being distributed by the following 13 URLs.

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Tela - Bring'em Out (Clean Version)

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Mucho Por Hacer - Entrevista a María Laura Villagra, profesora de Pole Dance

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Earl Klugh - Just Like Yesterday

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name= Iveta Bartošová a Petr Sepéši - Knoflíky lásky (Czech) — ????????? ??????? MP3 ????? ? 320 kbps # freeMP3now

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Michael McDonald - Matters of the Heart

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Murray Gold - Veronika Decides To Die - Piano Set

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=Nava - Cuartito Saloon-Borracho y Loco-Huracanes del Norte (cover)

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=?? ???????????? - ?????? ???? - ?????

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=KREED - O Bozhe mama mama ya shozhu s uma eyo ulybka svodit menya s uma

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=????? ??????? - ?????, ? ?????? ?? ???

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=??????? ????? ?? ???????????? - ????? ?????? ? ??????

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=????? - ????? ???-???, ????? ??????

http://setup.pereday.ru/.../?advert_key=ZWMwMDAxMDBiNDAwMDFmZjAwMDAwMWVkMDAwMWVkMDAwMWVkZmIyMDRmYWEwMg==&name=??????? - ????? (?????? "??????" 2013)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.