home

r.g._mechanics_assassins_creed_unity-3001-torrent.exe

INTIS

The application r.g._mechanics_assassins_creed_unity-3001-torrent.exe by INTIS has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from s52e.storage.yandex.net.
Publisher:
INTIS  (signed and verified)

MD5:
02767d7843036234b0b816e63c952d6b

SHA-1:
1de6ad54a23af6348edbd8470118340140d1b10e

SHA-256:
381ffbe4247bc2ae2574dfbeb6c51e58d85d7bd1bdf191cede5e2d7a8e3107dc

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/7/2025 11:26:22 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FileTour.INTIS (M)
16.7.5.18

File size:
2.1 MB (2,235,848 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\r.g._mechanics_assassins_creed_unity-3001-torrent.exe

Digital Signature
Signed by:
INTIS

Authority:
COMODO CA Limited

Valid from:
4/16/2016 4:00:00 AM

Valid to:
4/17/2017 3:59:59 AM

Subject:
CN=INTIS, O=INTIS, STREET="Prospekt 40-letija Pobedy, 69, 1, 8", L=Rostov-Na-Donu, S=RU, PostalCode=344072, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E0D42565A341BEBE1BAFBF6CA79F6420

File PE Metadata
Compilation timestamp:
11/13/1987 3:21:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
4.0

CTPH (ssdeep):
49152:Qb1nhFfbRkiPZn+DSHlCa4rIZ4vDUkukZi7:QbHpbKip0Sa7Ikuj7

Entry address:
0x205001

Entry point:
E9, F3, 0F, 00, 00, 86, FD, 8B, 54, 24, 0C, 68, FD, 64, 60, 00, 9C, FF, 44, 24, 04, 9D, C3, 0B, 28, 45, 81, E9, 8E, 72, 41, FF, E9, 88, 15, 00, 00, 6C, FF, E1, E9, 6E, 07, 00, 00, 5E, FF, E6, E9, E7, 0E, 00, 00, 59, F9, E9, CC, 0A, 00, 00, A4, C8, 8D, 89, B8, 00, 00, 00, 68, 1F, 96, 13, 41, 9C, 81, 6C, 24, 04, B6, 38, B3, 40, 9D, C3, 44, BA, 81, E9, 39, 00, 3A, 00, E9, 9D, 05, 00, 00, 81, C3, E9, E0, 02, 00, 00, 5E, EC, 05, 8D, 64, 24, 04, E9, 95, 04, 00, 00, 13, DE, BB, 64, 89, 20, 68, 14, CD, C2, BA, 9C...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
2 MB (2,079,744 bytes)

The file r.g._mechanics_assassins_creed_unity-3001-torrent.exe has been seen being distributed by the following URL.

https://s52e.storage.yandex.net/rdisk/68bec26150767634780cb483fec2f08d9e38d862567aec36efae6c19530f60f8/576c5a78/3Cc_001lyA5VNtjBH3uXgn5J70-4xniRXlOwRnCpW0hLA5tuBM0kQzi3uKnafkpxWCaZHh2VW87ZPEdulJCwSA==?uid=358710091&filename=R.G._Mechanics_Assassins_Creed_Unity-3001-torrent.exe&disposition=attachment&hash=&limit=0&content_type=application/x-msdownload&fsize=2235848&hid=d226f9188cf998a505abec7c5aab07fc&media_type=executable&tknv=v2&etag=02767d7843036234b0b816e63c952d6b&rtoken=39cserDDpZ2Z&force_default=yes&ycrid=na-ecab0457e3a48afd193bd1754c71a96a-downloader2d&ts=535f917718e00&s=108cba3d03d5b84dfd141783445e1a8421848a6de9bde9fb83f35fedaa5f8539&bp=/27/.../data-0.5:48081622136:2235848

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.