home

pokemon__edicion_esmeralda_(spain)-81666701-81666701.exe

Cat Lady Interactive

The application pokemon__edicion_esmeralda_(spain)-81666701-81666701.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from intva1.bitdesktop.com and multiple other hosts.
Publisher:
Cat Lady Interactive

Product:
Cat Lady Interactive

Version:
1.2.9.2183

MD5:
02404ffa4ac4de2681da6d7a728d3c96

SHA-1:
5d754fd41e12709ce8f7f8394402b2341ce08171

SHA-256:
ef74c4f5ee20b74469c6816bfb96b789c0d0fab6b2579c88f263d028eb7277a9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 12:57:54 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.CatLady.Bundler.Installer.Meta (M)
16.5.9.13

File size:
885.5 KB (906,752 bytes)

Product version:
1.2.9.2183

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\pokemon__edicion_esmeralda_(spain)-81666701-81666701.exe

File PE Metadata
Compilation timestamp:
4/30/2015 2:13:27 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:xAmxE8h4lzj4hi47WW2ymBVmTT5fOGIJ0kpH:Vx94FMSWJmBmde

Entry address:
0x1284

Entry point:
E8, E7, D1, 00, 00, E9, 07, CA, 00, 00, CC, CC, 51, A1, 14, F7, 4A, 00, 53, 56, 8B, 74, 24, 10, 57, 50, 68, EE, D8, FF, FF, 56, E8, A7, 3A, 00, 00, 8B, 0D, CC, F6, 4A, 00, 51, 6A, FF, 56, E8, 98, 3A, 00, 00, 8B, 5C, 24, 38, 53, 89, 5C, 24, 28, FF, 15, 40, 02, 41, 00, 8B, F8, 83, C4, 1C, 85, FF, 74, 63, 8B, 54, 24, 1C, 55, 53, 52, 57, E8, E7, C5, 00, 00, 8D, 44, 24, 1C, 50, 57, E8, 28, 76, 00, 00, 8B, 5C, 24, 3C, 8B, 4C, 24, 24, 53, 51, 57, 56, E8, B7, B6, 00, 00, 57, 8B, E8, FF, 15, 3C, 02, 41, 00, 83, C4...
 
[+]

Entropy:
7.9642  (probably packed)

Code size:
57 KB (58,368 bytes)

The file pokemon__edicion_esmeralda_(spain)-81666701-81666701.exe has been seen being distributed by the following 11 URLs.

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jbswswsswl41216&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-131289419_3.exe&checksum=164352

http://intva2.clientmulti.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Mega Man X-132800811.exe&checksum=168600

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=gimp-setup-125396369 (1).exe&checksum=127328

http://intva2.clientmulti.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Super Mario World-132781033.exe&checksum=168600

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jbaprl4182016&signature_id=0&_action_=getbin&filename=openofficesuite-setup-40238857.exe&checksum=165463

http://intva2.clientmulti.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Tron Deadly Discs-132795715.exe&checksum=168600

http://intva2.clientmulti.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Naruto Shippuden - Ultimate Ninja Heroes 3-94547227.exe&checksum=168600

http://intva4.developbutton.com/dl-pure?&usefilename=true&signature_id=0&_action_=getbin&filename=Setup-102744125.exe&checksum=108984

http://intva2.clientmulti.com/dl-pure?&usefilename=true&hashstring=jb3252016&signature_id=0&_action_=getbin&filename=Tom and Jerry - The Movie-132706825.exe&checksum=130068

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jbswswsswl41216&signature_id=0&_action_=getbin&filename=minecraftfreedownloadsuscom-setup-129569803 (1).exe&checksum=164352

http://intva1.bitdesktop.com/dl-pure?&usefilename=true&hashstring=jbaprl182016&signature_id=0&_action_=getbin&filename=minecraft-setup-66564447.exe&checksum=129224

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.