home

pth_1.19.0_by_hackod.rar_downloader_hu_99381.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application pth_1.19.0_by_hackod.rar_downloader_hu_99381.exe by Righway Technologies, Inc has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This file is typically installed with the program GoforFiles by Righway Technologies, Inc which is a potentially unwanted software program. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 464

MD5:
767228f5c58c922a3a0110a52e14dc99

SHA-1:
2c721c81ff5b581a314cc37d2404b20e398e6b13

SHA-256:
ded926b3485792fc0994524af8db4931556e2fac38f8006d88f91b7ff83e49c4

Scanner detections:
11 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 12:50:56 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.ExpressFiles
2013.12.24

ESET NOD32
Win32/ExpressDownloader (variant)
7.9190

herdProtect (fuzzy)
variant of hpilokeygenv3.zip_downloader_be_257.exe (Adware)
2013.12.25.0

K7 AntiVirus
Unwanted-Program
13.174.10588

Malwarebytes
PUP.Optional.GoForFiles.A
v2013.12.21.05

McAfee
Artemis!767228F5C58C
5600.7274

NANO AntiVirus
Riskware.Win32.Babylon.craswq
0.28.0.57029

Reason Heuristics
PUP.RighwayTechnologies.j
14.8.7.21

Sophos
Go For Files
4.96

Trend Micro House Call
TROJ_GEN.F47V0607
7.2.355

VIPRE Antivirus
ExpressFiles Installer
24664

File size:
5 MB (5,276,296 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
6/7/2013 1:06:44 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:A86g3fWRTrUn0wqsNhjtjGH5xJ4jfbYayg+3pxdbvHETOun:t/OT4n0whBjGZxJ4jTYW+fdoTOW

Entry address:
0xE8D6

Entry point:
E8, DA, 7D, 00, 00, E9, 89, FE, FF, FF, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, BA, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 49, 1E, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 50, EA, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, 64, E9...
 
[+]

Code size:
112 KB (114,688 bytes)

The file pth_1.19.0_by_hackod.rar_downloader_hu_99381.exe has been discovered within the following program.

GoforFiles  by Righway Technologies, Inc
GoforFiles bundles various adware toolbars including the Delta Search Toolbar (an adware toolbar that modifies the user's web browser home page, search settings and other settings).
www.goforfiles.com
70% remove it
 
Powered by Should I Remove It?

The file pth_1.19.0_by_hackod.rar_downloader_hu_99381.exe has been seen being distributed by the following 33 URLs.

http://dn.goforfiles.com/j5GTVmWQilRrlP4OO5jiMC74sDJms7ojNpKyI3a hCFtpYo5D7GNP1XymjJDvMxVHujTFEeCjgZfgMBWA9wxRBiYdkpzwz5JdM08TnPM

http://dn.goforfiles.com/j5HyF0rfu1p1lJ1eeNnxBmDduChgoas/.../ZwFgB0NsbSdUwQAneMU5wwDFM

http://dn.goforfiles.com/.../dC7XsD51pbdtYam0Kyf 0Wc4v5A1Vb2APxvt1G8d6dcXXeHEVAXUzFsD0c1a

http://dn.goforfiles.com/j5GAW2Pe6Xhg1e1zb860Ly6N9QJ pa8ueLC1b1KnlCE i5A RrXPLEu9iWIc6MVFXamXEF JnVYC1s5JTps8Qg3bNkN3xj5MdA==

http://dn.goforfiles.com/.../oIWTKuYDlbdwFIF08lJTps8Qg3bMU92wzlMdA==

http://dn.goforfiles.com/j5GxUmzXphtr3ahbZZilLHzZpyg0t7Qicvnrfy7ukiZ8u4g Ru3QYhbg2Xleq8xSHevBXwrTwVgF

http://dn.goforfiles.com/.../cvuBR1GBiw4Wyd0CW5poEhCWbAdkh2QSIsk7T37eYvYsi3juNj0gsmcyK6kuexyibTsUo1YlGq9X

http://dn.goforfiles.com/j5GDW2PdpFpomZpeZtShIn7MpWlgoattYam0Kyf 0Wc4v5A1Vb2APxvt1GwS6dcXXeHEVAXVyV4A3M1W

http://dn.goforfiles.com/j5G1X23Epkhu270fetejN2/euSIyt7AlcquqPDr/.../fMkV1wD9Od8A=

http://dn.goforfiles.com/.../IVgHXyl4H1sxeDA==

http://dn.goforfiles.com/j5GRX2eQnlN/lI5ebN33NGPVsXok8O1tZbG/.../C

http://dn.goforfiles.com/j5GRQnDZuk9nx tIZ9G1fjiM4WFhtbs8e625ciPx0mco6pEkH HabBPm320Y7cY=

http://dn.goforfiles.com/.../oIWTKuYDlbdwFIE08tJTps8Qg3bMUd0wzFMdw==

http://dn.goforfiles.com/.../l OPX9JH xhjZw6pI6S7TUbRbgyyxfuoYOR7jIXgvQzloQkI5SC9s2RgjaMEV0wg==

http://dn.goforfiles.com/j5GGWG/.../oYOR7jIUQLU3xhDhooCU4w8SgffMkNkhHpGd8c6THvMIbd5xA==

http://dn.goforfiles.com/j5GaF0fRukIm571ab9zxE22c4mkg7qsqZOKqInOs3GUu MMkV7KeNk w0GYT68lSCKiGWgPTzl8E1c5ZDN0=

http://dn.goforfiles.com/.../IVgHXzVMD0cxWAg==

http://dn.goforfiles.com/.../3kfCL5xydt8dRkFeTdbRTg1W4=

http://dn.goforfiles.com/j5GBWHXepVRn0O18Y8ywJ2vQpmfwQEprPvbtfinoA9ON7LUUC/.../YzQ=

http://dn.goforfiles.com/j5GWXmDVpVJzx 0IJIjxYy7vujJ8pPkIeaqpKnS8wXM jZAzS7 6OEmmiH9/tIUKQ72BAhLX11sWxN0/Uod1HG2PagUn0FwXMp1gHj6dMbRgzDv1M3I//DttebJsOBW1LXlH4A95TaZUJhi5HmsMkl0rBpVGEgieRg==

http://dn.goforfiles.com/.../coeanyKXOkhHwm tNvGuPdaxL732kalbAiaa7FUwPR1xlXltsYV4FlTgjcMVExhWsMK51pQnPBILZ62mH0bzEqvGUyLLttPRM=

http://dn.goforfiles.com/.../cMjUe3YaBHg32ga7MVX

http://dn.goforfiles.com/j5G2Q23As1Jq2Kwfa868YzyM5HQyq7wyNqO4ITy/.../RylwD1M1YAtAy

http://dn.goforfiles.com/.../Wu1RhlPsRPJi6JnfbsCk0t7Qicvnrfy7ukiZ8u4g Ru3QYhbj3Hleq8xSHevGVAHUyVkC

http://dn.goforfiles.com/j5GSXnHT6XJwkrpSY9zsdT6I8zRnoq4mf6DgdiP71mc4uJZqE Peax7s1G0d4Q==

http://dn.goforfiles.com/j5GEWXbRu151lIxJZcDxAXvSsSt34I84YuSPO3u7wWIw/.../SHnJIbs=

http://dn.goforfiles.com/j5GyXmzUpkx1lPofZtewJ2vO9XU8 fc5d7b7OHehhW4o/.../RylwF08paA903

http://dn.goforfiles.com/j5GCRWPAoVJl5qRJb8qOC2/.../oIWTKuYDlbdwFMO08VJTps8Qg3bMEZxwThKfw==

http://dn.goforfiles.com/.../ImnZuCJ8tPkKNoKyLG 7wRxw7KkyQ7SMKVX0ryYKmZ8NR7nVKlGrnA4Qk5AGXtU3QwrKdgIgh2QSIsk0RnnPJaU6jyi2YTcsvWM8LLpq

http://dn.goforfiles.com/j5GzVnHTpht0275MY5ajInyaoip7pOR9JvD7PG qlj53qNhlEOTPL1Xp3Gwd6cdUGO7EUA==

Latest 30 of 33 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.