home

October.exe

DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC. LTD. STI.

The application October.exe by DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC.. STI has been detected as a potentially unwanted program by 11 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software.
Publisher:
October  (signed by DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC. LTD. STI.)

Product:
October

Description:
October Setup

Version:
1.0.0.0

MD5:
01ad29d70ec3be97a2e2e1be564cabf3

SHA-1:
0fa80adfaff31faf448aa8f287c15059d7e23829

SHA-256:
bb72883adc55b2b9a586e8d528f11653a6e008137c4cc2074fea557f2200a207

Scanner detections:
11 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 1:28:03 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Joedown
7.1.1

Avira AntiVirus
ADWARE/Joedown.509672
8.3.2.2

Baidu Antivirus
Adware.MSIL.Joedown
4.0.3.151022

Bkav FE
W32.HfsAdware
1.3.0.7383

ESET NOD32
MSIL/Adware.Joedown.A application
7.0.302.0

Fortinet FortiGate
Adware/Joedown
10/22/2015

G Data
Win32.Application.Agent.GON20C
15.10.25

IKARUS anti.virus
AdWare.MSIL.Joedown
t3scan.1.9.5.0

Kaspersky
not-a-virus:AdWare.MSIL.Joedown
15.0.0.562

Panda Antivirus
Generic Suspicious
15.10.22.08

Rising Antivirus
PE:Malware.RDM.39!5.2D[F1]
23.00.65.151020

File size:
497.7 KB (509,672 bytes)

Product version:
1.0.0.0

Copyright:
October

Trademarks:
October

Original file name:
October.exe

File type:
Executable application (Win32 EXE)

Language:
Turkish (Turkey)

Common path:
C:\users\{user}\appdata\local\temp\october.exe

Digital Signature
Signed by:
DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC. LTD. STI.

Authority:
COMODO CA Limited

Valid from:
3/23/2015 2:00:00 AM

Valid to:
3/23/2016 1:59:59 AM

Subject:
CN=DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC. LTD. STI., OU=Software, O=DEY YAZILIM İNTERNET HIZMETLERI SAN.VE. TIC. LTD. STI., STREET=KULOGLU MAH.ALYON GECIDI SOK., STREET=no 2 d 2 beyoğlu, L=istanbul, S=istanbul, PostalCode=34433, C=TR

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
74CFE735D4A9C333262E54F219961F8F

File PE Metadata
Compilation timestamp:
10/19/2015 11:26:19 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:BMGsgL7GZOsLa30hTb1S/y7qsKQ0jnAt4BknkqVBYUd:B/nGZY09pS/kBKQ0jnpBknkg

Entry address:
0x6B68E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
422 KB (432,128 bytes)

Remove October.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.