home

OMGPrivacyShieldSetup.exe

OMG Privacy Shield

Vast Tech Support

The application OMGPrivacyShieldSetup.exe, “This installer database contains the logic and data required to install OMG Privacy Shield.” by Vast Tech Support has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from RevenueWire's SafeCart distribution platform tpsite.omgto.safecart.com and multiple other hosts.
Publisher:
OMG  (signed by Vast Tech Support)

Product:
OMG Privacy Shield

Description:
This installer database contains the logic and data required to install OMG Privacy Shield.

Version:
2.2.5.23

MD5:
e611927a71cc2c5045ae38bf398fef02

SHA-1:
332c60017a2e462708b59721881a2e3f60428833

SHA-256:
1c557f2c6bf6e207df8ba4e658dc5d2aa3fd9209787c0a18309c6c40321bead7

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/25/2024 1:51:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Installer.VastTechSupport.V
14.12.16.10

Trend Micro House Call
Suspicious_GEN.F47V0713
7.2.238

File size:
4.3 MB (4,555,584 bytes)

Product version:
2.2.5.23

Copyright:
Copyright (C) 2014 OMG

Original file name:
OMGPrivacyShieldSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\omgprivacyshieldsetup.exe

Digital Signature
Signed by:
Vast Tech Support

Authority:
Thawte, Inc.

Valid from:
5/24/2013 3:00:00 AM

Valid to:
5/25/2015 2:59:59 AM

Subject:
CN=Vast Tech Support, O=Vast Tech Support, L=Delray Beach, S=Florida, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
074DFF23E064F33AB5EC78F8BEB7D2F2

File PE Metadata
Compilation timestamp:
5/21/2014 12:03:40 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:j2BxX/sFFsoWHKesf35Xegbl7+MJNx4hfz0Kxv8bCDviabyaIG4:jWPA5XF+MPxmIcv8Gbiabj4

Entry address:
0xC4C6B

Entry point:
E8, 42, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5E, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C6, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 3A, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A2, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0B, 4E, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Entropy:
7.6594

Code size:
1004 KB (1,028,096 bytes)

The file OMGPrivacyShieldSetup.exe has been seen being distributed by the following 3 URLs.

http://tpsite.omgto.safecart.com/.../download

http://tpsite.omgto.revenuewire.net/.../download

http://toolkit.shieldapps.info/omgprivacy/.../OMGPrivacyShieldSetup.exe

Remove OMGPrivacyShieldSetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.