home

saveas(brazil).exe

IT MANAGEMENT GROUP LTD

This is a bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application saveas(brazil).exe by IT MANAGEMENT GROUP has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the New IT Desktop Setup installer. The file has been seen being downloaded from www.adshost1.com and multiple other hosts.
Publisher:
IT MANAGEMENT GROUP LTD  (signed and verified)

MD5:
022b286e9581a49b70431d55787807c2

SHA-1:
7756ea67b3fe77cc4a6c97732f5e5900f9b20947

SHA-256:
ff254c22ce4acb6ed16d7a6b80dc73a6bd8b9423e19620ec86626a046fdaab70

Scanner detections:
8 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 6:11:07 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Downloader-TQP [PUP]
2014.9-140613

Comodo Security
Application.Win32.NewIT.B
17828

Dr.Web
Trojan.StartPage.57898
9.0.1.0164

ESET NOD32
Win32/Hao123 (variant)
8.9458

McAfee
Artemis!8AE4DE4F2611
5600.7101

NANO AntiVirus
Trojan.Win32.StartPage.brovgw
0.28.0.57630

Reason Heuristics
PUP.ITMANAGEMENTGROUP.O
14.9.11.21

Rising Antivirus
PE:PUF.4Shared!1.9C25
23.00.65.14611

File size:
1.3 MB (1,358,184 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
New IT Desktop Setup

Common path:
C:\users\{user}\downloads\saveas(brazil).exe

Digital Signature
Signed by:
IT MANAGEMENT GROUP LTD

Authority:
GoDaddy.com, Inc.

Valid from:
3/15/2013 7:57:25 AM

Valid to:
3/14/2016 10:41:32 AM

Subject:
CN=IT MANAGEMENT GROUP LTD, O=IT MANAGEMENT GROUP LTD, L=Limassol, S=N/A, C=CY

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
082965B7976A8F

File PE Metadata
Compilation timestamp:
4/1/2013 1:09:08 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:th76AOYs4DUt2PjEllUxcRz5SHNPHHmbFV6f4NYz3D7S+dq:twAOYs4Dy2PjoR9SHFGV6f4Na7Nq

Entry address:
0x495F

Entry point:
E8, 6E, 3B, 00, 00, E9, 79, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41...
 
[+]

Code size:
47.5 KB (48,640 bytes)

The file saveas(brazil).exe has been seen being distributed by the following 16 URLs.

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1366054867373&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365243095040&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365549167224&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365388941606&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365365752137&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365029705483&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1368309968674&u=http://.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365543278064&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365787718440&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365526456777&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365368627317&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365863904516&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1366161311218&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25041&p=5268&c=10178&l=BR&h=a50982dffa693dd6d781d2eeed87585f&t=1365979451580&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://www.adshost1.com/cr?b=25042&p=5268&c=10178&l=BR&h=cc67f80ceb16c1115b67f915a1f055ba&t=1365417784773&u=http://cdn.getdownload.net/80A164/.../SaveAs(Brazil).exe

http://getdownload.net/SaveAs(Brazil).exe

Remove saveas(brazil).exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.