» reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe
Overview
Analysis
File Details
Downloads (1)

reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe

PileFile downloader

LADY'S WOOD 2013 LIMITED

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe by LADY'S WOOD 2013 LIMITED has been detected as adware by 21 anti-malware scanners. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from www.shar-m.com. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

Publisher:

LADY'S WOOD 2013 LIMITED (signed and verified)

Product:

PileFile downloader

Version:

1,0,1,1973

MD5:

6239016d2289ddff86dbe441b80f380a

SHA-1:

a1af56f4af271e46636cd99b29e03460392a3b06

SHA-256:

24bfe54d393e3f6edb1633347b1ecf52ca359800becd2eb56f7483478872addb

Scanner detections:

21 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup. Distributed through the Brightcircle investments brand.

Analysis date:

12/28/2024 9:22:15 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Downloader.Oxy.1

878

Avira AntiVirus

ADWARE/Adware.Gen

7.11.171.112

avast!

Win32:Adware-BLB [PUP]

140908-2

AVG

Generic

2015.0.3356

Bitdefender

Gen:Variant.Application.Downloader.Oxy.1

1.0.20.1260

Dr.Web

Adware.Downware.1659

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Application.Downloader.Oxy

14.09.09

ESET NOD32

Win32/BundleInstaller.D potentially unwanted application

7.0.302.0

Fortinet FortiGate

W32/Agent.PFR!tr

9/9/2014

F-Prot

W32/A-6e1bfd6d

v6.4.7.1.166

F-Secure

Gen:Variant.Application.Downloader

11.2014-09-09_3

G Data

Gen:Variant.Application.Downloader.Oxy

14.9.24

IKARUS anti.virus

Trojan-Dropper.Agent

t3scan.1.7.5.0

Malwarebytes

PUP.Optional.FilePile.A

v2014.09.09.01

McAfee

PileFile

5600.7012

Microsoft Security Essentials

Threat.Undefined

1.183.1966.0

MicroWorld eScan

Gen:Variant.Application.Downloader.Oxy.1

15.0.0.756

Panda Antivirus

Trj/Genetic.gen

14.09.09.01

Reason Heuristics

PUP.LADYSWOOD2013LIMITED.

14.9.9.13

Rising Antivirus

PE:PUF.FilePile!1.9E19

23.00.65.14907

VIPRE Antivirus

Threat.4847483

32938

File size:

4.9 MB (5,173,688 bytes)

Product version:

1,0,1,1973

Original file name:

Oxy.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe

Digital Signature

Signed by:

LADY'S WOOD 2013 LIMITED

Authority:

COMODO CA Limited

Valid from:

1/28/2014 3:00:00 AM

Valid to:

1/29/2015 2:59:59 AM

Subject:

CN=LADY'S WOOD 2013 LIMITED, O=LADY'S WOOD 2013 LIMITED, STREET=COMMUNICATIONS HOUSE, STREET=DEAN ROAD YATE, L=BRISTOL, S=SOUTH GLOUCESTERSHIRE, PostalCode=BS37 5NR, C=GB

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00F93831D83C5CE9CF3BB3658BA83359DB

File PE Metadata

Compilation timestamp:

2/5/2014 9:57:30 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

49152:y9iSOa3pXE3llwQKwdgiVPy5lcXsWRO92EfQR25k6vjO2gXOuuKXjS:8v7S9KwdgikcXsWRsf957OJXOuuKXG

Entry address:

0xA9C20

Entry point:

E8, 2A, 71, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, DC, 06, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, 44, 54, 4E, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 66, 71, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, B0, 9D, 4A, 00... 
[+]

Entropy:

5.3012

Code size:

760.5 KB (778,752 bytes)

The file reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe has been seen being distributed by the following URL.

http://www.shar-m.com/.../reference_manual_for_magnatic_resonance_safety_implants_and_devices_Downloader_276600014.exe

Remove reference_manual_for_magnatic_resonance_safety_implants_and_devices_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.