home

sai russian pack v1.exe

Tohekat

SpeedyPrompt (New Media Holdings Ltd)

The application sai russian pack v1.exe, “Tohekat Setup ” by SpeedyPrompt (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.newtourshare.com and multiple other hosts.
Publisher:
Kup   (signed by SpeedyPrompt (New Media Holdings Ltd))

Product:
Tohekat

Description:
Tohekat Setup

Version:
4.8.4.0

MD5:
614e984c2fb3d1beca5474134c5196ea

SHA-1:
45175f359830f384f57d113eb55bb64a44b8910c

SHA-256:
060e58c0909ba90955d84585e4ea292f828840b601555073025f39544dba1d87

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/23/2024 6:14:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.15.18

File size:
951.1 KB (973,912 bytes)

Product version:
4.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\sai russian pack v1.exe

Digital Signature
Signed by:
SpeedyPrompt (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 4:27:56 PM

Valid to:
6/1/2016 6:18:59 PM

Subject:
CN=SpeedyPrompt (New Media Holdings Ltd), O=SpeedyPrompt (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217859832E1C02CFE81458CC264243B14E

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:q7MtbV/r2oxmgWeLEYb2VxnJ+cCkCMm4xQuM:qwX/r2YmHIMxY34xQD

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file sai russian pack v1.exe has been seen being distributed by the following 12 URLs.

http://www.newtourshare.com/WVl6OTRQVGh4ZEcxQlpHRkVZbE5rVlU1U05qVjBibmcxVmpSVlVVMUNiVzFpYW1ObWVERkdRemxPUkVWTU5Va2xNMFFtWXoxek5UUlRlVzF5Wkd4RlRrUmhUbTQxVFZCTWFUZHVjSEZNVVZGdFZtWlNOVFZ0WW5CR1JqbEVZMDVXY1hGUUpUSkNXRWczTTJwNmVreE1iWEp2Tm1KWWVHcEVKVEpHSlRKR2JsVndWRWxGWVRaM1dVeFZSRGQ0VTNoc2NpVXlRamh2VVVkcVFrWnBVRll5VTFjeU5VTkdSazkxTVdSeVNuTTRWamN3V1VsdmNFZFpZbkFsTWtacWQzWW1aRzkzYm14dllXUkJjejFUUVVrclVuVnpjMmxoYml0UVlXTnJLM1l4TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVwY205dWMzSmpMbU52YlNVeVJuUmxjM1F1WlhobA==

http://www.newtourshare.com/WVl6OTRQWFZhTVhWTVduVmxTa0V6ZFRWa05YSlBkWEo0UW5OaFJFRmhWak1sTWtKWlJrZFlSR1JMT0hKTmVsTldZeVV6UkNaalBYbEpURTFaU2xWWGVYaDFiM0JXTTB0cFRrVktPRXhEZFdneGQwRnNibXBGVlZsRU1FTlpTRzlzVGxwNVdIRmFNVFZsY1RKSGNtUnNjWEZWWm5jM2JWcG1aVGs0VjNCeFlWSm9lbU5tZWxwV1JFMDFORFEyTW1SeVZYVkhhbVZxZDAxR2NrUTBlVXAwUVZoS2NITmFZbTUwUWpRNU5qWmhOWFI2UkZkcmFsRWxNa1ltWkc5M2JteHZZV1JCY3oxVFFVa3JVblZ6YzJsaGJpdFFZV05ySzNZeExtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1cGNtOXVjM0pqTG1OdmJTVXlSblJsYzNRdVpYaGw=

http://www.newtourshare.com/WVl6OTRQWEowTm01S1VHTjFSalpNVENVeVFucG5TM0ZuTjI1dlptaFBUREpYZEdFelVEZ3hWQ1V5Um5reWFtTllhSE56SlRORUptTTlTVzkxWWtOdWJUSXpPQ1V5Um5Vd2VHaE5jRXh6YW1sdVkzQklTVTgyTnpGUk1VbGxSM05GYmpkSFYyYzBlWFF5VFdOdGMwdDFkR2hhYTB0RFRqWXpkSFUwU1U5V05XTkVRVEZ1VWs1Qk4wWndVR3BRZFRaVVRsSXdSWFZTVmxZbE1rWmpUVEpuYUUxR2JVTTVjREJCZGxZd2RYRlhjRkl3YWpCQmFIcGFUa3RJY1hSckptUnZkMjVzYjJGa1FYTTlVMEZKSzFKMWMzTnBZVzRyVUdGamF5dDJNUzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VhWEp2Ym5OeVl5NWpiMjBsTWtaMFpYTjBMbVY0WlE9PQ==

http://www.newtourshare.com/WVl6OTRQVTVZVGtKeFoyeDNTeVV5Um5wQ2VtNHlhM2xMYjFCSlVHaFFNeVV5Umt0SlpuSTRWVlZuZGsxUFRIRmhSVFZuSlRORUptTTlkeVV5UWtoWVltVjJaV3B6U2prME0yOWpkV3BUU2tGNGNtbEpOWHB0UmtkYU1sRlVZMFZzV0d4SmRYUXpTMnNsTWtaTk5rOVlNV055YVc5SU1YbHFaMVphY2xKemFFTlljSE53YVUxM2JubHRlbWczVFVwR2JVdHZZa3hSUzBRbE1rSkRXRUVsTWtKbFpYQjFRVGRGWkZCMUpUSkdjeVV5Um1KQ2RGZHpiblJTUkZCWFZsSTNXVmMzWTA4bVpHOTNibXh2WVdSQmN6MVRRVWtyVW5WemMybGhiaXRRWVdOckszWXhMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NXBjbTl1YzNKakxtTnZiU1V5Um5SbGMzUXVaWGhs

http://www.newtourshare.com/WVl6OTRQVEpqVmxwdWRuYzVjMVUyWmpad2NHaDNRWEowV1dVeGJUWXpabTlsVEZWSGN6QnVjMkpFSlRKR1lYVkxTU1V6UkNaalBXb3hhWFp4SlRKR1RXazBiRWhySlRKR1lraFdheVV5UWt0bWRpVXlRbmxGWkRVemJXdEtibUp6YWxOUVRFMU9TRFJ4VVVOU2R6VnhOMU54Y0dOb2JWcG1WMWxVUlRaeE4wbGhjRmxqTmtObVVTVXlSbXhJZVRBM1J6Tk9kSFprWkdSTFFqWjVWRXBqVlhwcWNtTnhNbTVwZEZabVNHRTViV1ZSVGpoSlMyd3lKVEpDVHpsTVIzUjBKVEpHZFdNbVpHOTNibXh2WVdSQmN6MVRRVWtyVW5WemMybGhiaXRRWVdOckszWXhMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NXBjbTl1YzNKakxtTnZiU1V5Um5SbGMzUXVaWGhs

http://www.newtourshare.com/WVl6OTRQVkJsYWpCNE1saE1OM2RrVHpoaE1WZEVTaVV5UWxGblNtczVkU1V5UW1wNVlYQmFXbFpwWVRKTmJVZFRiV1YzSlRORUptTTlOM2RvU1RSYVRuRnVlV2xGUldvNFR6Tm9jbGhXY1VGVWF6RlpiMmhLYUhKRVdFOWlVRGxYV25wNWRrdDRWa2cwYm1sTVZrbDJiVzBsTWtKcWVrSTJVR00yWTBOTVRrWllkR1ZtY0ZCeVdscHhSVWRDVG1wQmRFSXdaWFZIVkdwNFRYUkVjMmM0UzNkaFZGUkRVbWR0UWpReGJXWldNVmxQZG5WUVJXdHhiMGw2TkNaa2IzZHViRzloWkVGelBWTkJTU3RTZFhOemFXRnVLMUJoWTJzcmRqRXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtbHliMjV6Y21NdVkyOXRKVEpHZEdWemRDNWxlR1U9

http://www.newtourshare.com/WVl6OTRQV0Z5UzA5aE0xcHZXRzlwUkhjeE5uTktOWEpzYlZwelluUXlhRVpVZG1kT1VXcDFaekZpYVRJbE1rSkNaeVV6UkNaalBWSmFNSEZYV0dGU2RsbFRjSFJvZW1GbVJITm5UV3N4TW5Oa1lWTXlOalZ4YlhSQlpsTm9aVFZyTTJoTlEyRk5XRVZCWlZOak9VUjVPVUpLZERGeVRXUkJiM05XWTBWRllYRkxVMjUzZVZCelpETldlazVTUlVKNGIyTTJiM2hGWlhwRE1pVXlRbkl5ZUdaRFFXTmxkMWhDT0ZKalRqRjVSVzUzVld0NFFVeE5hVThtWkc5M2JteHZZV1JCY3oxVFFVa3JVblZ6YzJsaGJpdFFZV05ySzNZeExtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1cGNtOXVjM0pqTG1OdmJTVXlSblJsYzNRdVpYaGw=

http://cdn.saipainttooldownloads.com/WVl6OTRQVU54V2tkaVZFWlBTVWhFVkVNNWFXNVZZM0E1ZVNVeVFtaGFSMUk0U2tSbE0yUTJkMjF4VUhWcVRsVm5heVV6UkNaalBYTjNSMnBwTVUxdGFsZGhRVGsxWldOaVMwbHJWblJDZEdkc09IbHRabVE1WTFONGRIVTNUSGMxYzNKdmEyd3dVemRHWWlVeVFqRlJZeVV5UmxSbEpUSkdVRzFzZWpKSWRGZG9VbTl6VTJsWWNWbG1hM2RpT1V0TkpUSkNlbU5WTVhGV05rbFhjRGw2U1dnME9WQjRXVFVsTWtKRFN5VXlSakV6TWxBbE1rSTNlR1JqWjBKSFJucElhV0psYTNVbVpHOTNibXh2WVdSQmN6MVRRVWtyVW5WemMybGhiaXRRWVdOckszWXhMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NXBjbTl1YzNKakxtTnZiU1V5Um5SbGMzUXVaWGhs

http://www.bitsuniversepackage.com/WVl6OTRQVFJMZFZSWVkwZHpPVzluWXpKV1pURTRaM2RIWlcxVGNqYzNaVmt6TTFkVVozQnljRnBtVm5CVVYxRWxNMFFtWXoxaVNrSWxNa0kzTVZkUE9GZHlhaVV5UWlVeVFtOW9TVzAxTjBwdE9HUmlTVzVrVm1WVU9FRm9XSEJaU2pCaGJHNW9SM2xyZG1OdWJHOWpTREZ3ZURWclQyVktPWEE1ZVVwd1JFOVRaMjl5SlRKQ1RHNU5SemR3SlRKQ1pVaHNKVEpHWTFkV2FUbDJibUZEWW5OTWIwdFdKVEpHYkRSSmQyVkdWM0pHVkZadFpHUk9lRkpIZGxKTFVHd3ljMWxzSm1SdmQyNXNiMkZrUVhNOVUwRkpLMUoxYzNOcFlXNHJVR0ZqYXl0Mk1TNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdWFYSnZibk55WXk1amIyMGxNa1owWlhOMExtVjRaUT09

http://www.bitsuniversepackage.com/WVl6OTRQWFZoVUdKSmRubHBSV2hsZWxWclNrZHNZMHROVnpOYU1VSnhkR1IzZENVeVJubHhSR0ZUYkZRbE1rSjBkSFpSSlRORUptTTlZemxWTXpKdWQzUkhOM293UlRZbE1rWmxZbU5GVEZkbVZVSjVkaVV5Um00eloxZ3lKVEpHWjFWU2JFWndWekExWjFwd2EzbGpSSEpNU2sxUmNXbGhORzUyVGxReVoyVTJaVTUxYjNweFRHTmxTakJRVG1oT1EwNVlKVEpDWTJGdlFVUlpXbFpOWVc1RWJVNURhbVJKVDJKU1F6SlhVMmxKWkhaT1MwUkhWelZuY1dFeE4xRndaQ1prYjNkdWJHOWhaRUZ6UFZOQlNTdFNkWE56YVdGdUsxQmhZMnNyZGpFdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1seWIyNXpjbU11WTI5dEpUSkdkR1Z6ZEM1bGVHVT0=

http://www.bitsuniversepackage.com/WVl6OTRQVGx2VVc5TVNpVXlSbllsTWtaWmFFdHllalZDYTBOVGRWaEJhbHBVYjJWUFowWjJWVkJ5VlRWc1NUTlRiVmR2SlRORUptTTlTVVZtWlRaSWVHSTRaaVV5UmpsNmJuVnVkV0kzUkZveFdFYzJlWFJxTUZaTWVreEhWelJzV1VzbE1rSkRURU5SWm1Ka09VbEthSG96TlVKV1JIQllSbTltV2xoM2NWQkpjVlY0Wmpaa1QyNVlZa2s1U1dsaWNuUlpkR1l3WWtkSFZuWnpSSE5IYXpsQlJYVnBaMmhwUnpORFdWaEdSRlJyUW5Zd2RXRnpabGhrT0RkcldWZ3pkRTFMWnpSWE5XZGlkSEpEVVZKalZXWkRkeVV6UkNVelJDWmxQVEFtWkc5M2JteHZZV1JCY3oxVFFVa3JVblZ6YzJsaGJpdFFZV05ySzNZeExtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1cGNtOXVjM0pqTG1OdmJTVXlSblJsYzNRdVpYaGw=

http://www.bitsuniversepackage.com/WVl6OTRQWGcxV1RSYWFHZHJjbWRxWm5CSk0wZzBjVUpZUldobFlUVnNUMVJ3YlZwelNrMDRjakk0VkdSbE1uY2xNMFFtWXoxMGExaEhOVWw1ZVVKNGJVOXNVMmhTYTBOMmVTVXlSazVpWjNJM1l6SjBaWEpIU1VSdlpUTnNXblEyV0VOclNWaFZZbHBGZWpoNk5XcFhPVEJLUjI5amNFZFlTV1J4YzFWa2NFMXllRTB5V0NVeVFuZHlUWGcyUldsR2RGQktXVWdsTWtKNk5teEliMFpWV2psUlRVRm1jVVJ6TmpsS2J6bExXVFpwTWpOeE1URkpWMHBDZGlaa2IzZHViRzloWkVGelBWTkJTU3RTZFhOemFXRnVLMUJoWTJzcmRqRXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtbHliMjV6Y21NdVkyOXRKVEpHZEdWemRDNWxlR1U9

Remove sai russian pack v1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.