home

sai russian pack v1.exe

Tohekat

SpeedyPrompt (New Media Holdings Ltd)

The application sai russian pack v1.exe, “Tohekat Setup ” by SpeedyPrompt (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.newtourshare.com and multiple other hosts.
Publisher:
Kup   (signed by SpeedyPrompt (New Media Holdings Ltd))

Product:
Tohekat

Description:
Tohekat Setup

Version:
4.8.4.0

MD5:
e7ea198a77796fc52385d298e6fe9816

SHA-1:
d28b4f8938eda30a6724e9fa46658e3df743ee8b

SHA-256:
9c7c3a79104ae85e486a9bf3e5a538f7e5957a800718ec8665c8a879563359b8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/23/2024 7:36:02 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.16.6

File size:
951.1 KB (973,912 bytes)

Product version:
4.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\sai russian pack v1.exe

Digital Signature
Signed by:
SpeedyPrompt (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 4:27:56 PM

Valid to:
6/1/2016 6:18:59 PM

Subject:
CN=SpeedyPrompt (New Media Holdings Ltd), O=SpeedyPrompt (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217859832E1C02CFE81458CC264243B14E

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:M7MtbV/r2oxmgWeLEYb2VxnJ+cCkCMm4xQuM:MwX/r2YmHIMxY34xQD

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file sai russian pack v1.exe has been seen being distributed by the following 19 URLs.

http://www.newtourshare.com/7lFGwcxHmp9HSJn0baX f7FQB0zDhvjTZOaBTAOCTeR aapO9GYgPdZKoLzXoA6v10sIpN7kiIw9kStGQhazjqLo4xDM5sx7J2FD ArWAZtXTW2g btDj8a KRSBXrX5RNiJg32p2qgmL_QryWNtoOqeEfj0FNhBu7xzEORllGDEGXq1zPb04 L88ru8p7hmH7iCYSWyYp62UBX2O_3nQut6WOcX8kO egHKfC0U2UHLvMi353_IhsKwlCWHWJ1G7BC5UHfIgty0o84uXX daLOtWlfWvbyVVxEY967JNjCt0Hzlvz1pEikaucxFsiqIgerHvjL8BRW8S_HLgl2aYSGrIGI9cz54WaFdVzk60NuupVnRSNc=-Gx4AAAQccmiptINUUAtSyCa66I3zQN4Y WRVY5yNThw=

http://www.newtourshare.com/DJFQeZ3KeKPi7WrRVO5XKSjS9uwg3y0jB8aIs1KIkwLNjBr9lE88LMhdB9RD8KlaUoCV412BWpvqmmVtjjQc51GGW6G59U_D78v6PVIvbPkEJepFsURJPvGLroyxxrWrQfbO 5yUJ3mDlucYI22h7BnyODRJaV4SPSjuGsO2ePTwp3Ze6LafyCfpv2fK_8oJaZW1WXS2rwaGP3mtwL6fpyUilzcnTwikNLRHfqzFWFKMYTKwLUvAHZLVHHOrlELQR7c8XFcKsNVEgf11ZQUxI8tFHQCQuVr2 tDiQizrflsIPS3oPmwT947iun1HCQA_q1FKwKgZbZfk WLOt6ZGQUSMsFNzItS3BRsUHMDE2CXUq3RX6yc=-Gx4AAAQccmiptINUUAtSyCa66I3zQN4Y WRVY5yNThw=

http://www.newtourshare.com/c?x=Upco2xAgPc/79HE1lsA60srJzpxw/dgK9hhDB2bHAhg=&c=iIQWrwaJ7j2JT6tILAp hTP9eHWZNQ4HqiIIaSrIbOesfLK1W7ZZqMii5XBhCWbT6eigM6K9x6YqpUnTzWzDwwfQV9nvVuRLQPEZe0T/TQZ3iSeYh8gcHJS9KanyXZXa&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.newtourshare.com/c?x=LK7vQVayrwAzC5kUhZjKohgKRR2q6JG2q21pdr0J KA=&c=C1P672ZZqn1WvRV5YkffUTETy2dFAGKinZ 8SxrDVN3dR2lJIWiXU0LYd1WlaPZ1zuji6Kbg5Ub 8YFGrbjP5BEtJpsHhsjHouUTC30VjmWbuRLDBu7dpFfWQIQQav0O&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.newtourshare.com/c?x=oCOmBiDdYVLyPlYZz6pkaKkEJHsEIt/YbzpEXJJ9xvQ=&c=CuG2pbr/TZoRfMCCrCFIihgv8i2PxpA1h2RN1ZvOZLrH/oxEt7hhDTv lEXde/5Mnpia2Hhh0Qno2 vMHrYciXAfyg5Bicw6K2P9 C1VXIEW58HXuSWLYbsbRzRWIsbu&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=aigD1vIwUHChIsJbWWWz sInti/Niw5BwnMvQObBHb4=&c=v/hCZCP6sw1AkWmRTMgZJDMAi gXUmXfzKyJHO4k9Pq1C5E8yNi0R7h28lJ3lyKpzx5A85aw4sZ4L2OECJMYciT2GucK3KJaFIKH7LOKhN6 CMUj/HJKEcHDSt4uYens&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.newtourshare.com/c?x=moPgE5gRTdu/g7B1fJiSbGNbL9hqb6gQUyw 7ej96qs=&c=bzO9bf67HfKnJCS5f8/BG/M0jOIQkkei7LRuSR9sDu/ZQcih6Nmou78XdDPSRTI2Q/V5qmG2xow6Fz9hN Wi5/Np06NBbpPo6BbuWBBt 7 GUK1F ImJwCThN/iyMcJF&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=VSObmKNu6 RbyO/8i9peAW9RV3o/YbpaN6JpzDuH6uU=&c=02uWreZ7mJ8yUVOEn4CKKgWOKUhq6iy6IVQYe/ARiKJf w9YEHy vvmgScGCM1KXG4GLC4v0GizO2a44oKif M2MCDXe4DtsZMVD3fjQiFMdM7vZwraPi aHRzvFt RZ&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.newtourshare.com/c?x=kkuySOfU/gym UQ/7kYHnH7MI4OHPAQARmVcFUMLW9k=&c=1KPrqcnTbxVVMFrZ40XiKpLLFesx6O/NfmPZgwqS1N6xusHcwIhzJ4mvjUlqU3fKSYS16HHuG0CclK yNfEvJ19sTgUZ10VClSqNx39dLWbImIij4EpdYybb0DAd1T5P&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.newtourshare.com/c?x=8dSfD27S8K1Y/Envg6tCrmCP0kT2hSFegKoxpjc6/nc=&c=dV1n8ifCsyLePapeQopuX0ElwSmdHurVRFYWc5eAGdTJhKugCGEfpt0GYfnCdK6OYtpn5BWSWiYVXI2Xk4iVfTfMfp7eAsihukALL06KH7d2I1A86Ttrl1VIFEeX6MTO&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=L/5i7o8jiEoP3lFjFFjb0gqZvbEZvVD8kPOCOE3AEFE=&c=okYb7QR/d70Rry7OzODFL68PctqoZ98OQZ81CgrcVwgPWgexsTBF7mbD59UgNhSljzgvErSOliIucsGjgv0tO278eHtn6MMrAB6GMc x4Z9i1iMbjNCa5dC27cFQizt&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=hDt85 Ol4he3HjBawcEt3kWkmJaoOz/fUOVUX7F4T4U=&c=iBuG5gJee3X47YC9RDxfTPFptaiRduTO4A6ukTBsMRbEtu/dRZuU/XM9YamoJ1lIQaE3PV6jkzWCHp4k HgJZX3N63kqsZ8thnjyGGPHvEKwVryc1E8cbXoDOwiJpi8M&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=XB7VhAf2hGrqNh xDqgrbnFlPGjvHc6QstJbihjtKK8=&c=V/0/y8gEYC6u3ZkAN9llu5FUrxmOOQJHvrLIQMMUJMJ9CT9OIfVYVHOiWO2FpPyI1MN7hkN84ghKvl0Ywreijb/Qd3B6c2Pa1NDyKFbrCmxvaqXr7ZEIqo9bzxUnRnTN&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=ubrPMh/sHmdIDJU1joSsoYS8JeYmiEa4pFwnPLRRECo=&c=y5NNhH vTPy4MFR2uj/CQOjfhdeu7EYPQoEjIPdLZwOSth/hezXhdZR42b 9T0Q4GXOYnoqfE7bbNDi/azCfk1bNCIVIoP00tjy0x29n u/OEl 0DuSKzX3Nj3nbP2yX&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://cdn.zayatsdelivery.com/c?x=IPBgAKTZ5G3RnSd6KGWOzx400hSgsGRnG8P2w7hzkM8=&c=HQ3oH1YiIrJPXvmXUjq6eaN4FAkRbPoHFR5c1k7CuS4YWgWNHP2vSxZLWGqWtNrnDvICqdsQJ2uNTRYXJ8jE4VTfORb9xXBYAVz5qgqpw7suOLAhgVMHU1jtEr8zcuYg&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=/uczoPXL6jfucRhwOA0bMAeeUheBJaQj9RkUcC EHuU=&c=FFVFjrwSDITjRbrrckzzommn0Elxq5FvbaHEzWeFPreRAO1rI1AZ2RzYlskPBNPOT7j6OODAkFQw/uLRjDgBKOrtKMhCz2d43sCKwsQbcNWztRuNL/j8eQAsUiU51LAb&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://cdn.zayatsdelivery.com/c?x=OP1qDBgGE1BvTP1t2B0uswNO5rbzj0SFOXt4oO Qv7k=&c=nwMtuA/MX1Qwut7rOa4wpaUdYH9Avccwvx9jHVYo/c/cxsFrdImvnSSyB8r4LGBqho4TE8YH70xthqhrMs2EZToqgO0lKXHtp5Z47SLZ1CwIU4q64bcnmuqfnHmKHIlL&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://cdn.zayatsdelivery.com/c?x=7KDLxRF6emVriKriMMROfMsaxrYTnIzZdDonsCTKeiM=&c=eb6s 2CCzDqK7kcxQyQbG2KrA7gmJnjtXXXQ1yhOgFxx694BX6usY9ULJDezOUDfQu6xW05/WyagGjZgzgAyXBFSN5KMfmm6A1j3TLu bFKsAqi9IUCoYDmfoJLQwDJ8&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

http://www.bitsuniversepackage.com/c?x=Jt gscjbzRsXr63se pmZmV94TipBt4WbdEfxzx1Se8=&c=YuiwTFEZDDR9LDA5ukGHNoweNPu72A2SZ6rqS7VxWHzEQD842gZFtHB5ralOSw1YAwup4IrkoY3SL8NH4ctnnbDCDCVI5dk53V//W74kggQLx5cZavq IHT56rTSOkWa&downloadAs=SAI Russian Pack v1.exe&fallback_url=http://.../test.exe

Remove sai russian pack v1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.