home

sbs_ve_ambr_20170211100736.001_ 313

SmileFiles Installer

Webitar Production Inc

The file sbs_ve_ambr_20170211100736.001_ 313 by Webitar Production Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is also typically executed from the user's temporary directory.
Publisher:
http://smile-files.com  (signed by Webitar Production Inc)

Product:
SmileFiles Installer

Version:
1, 0, 510, 1

MD5:
f49665426aa0854dc38e4d80cca1daf3

SHA-1:
b70389e3d5d6d6daac5b473fdf7fee77a7a6b125

SHA-256:
0be9e01835ccead316cac612807d4bef8757b2be595af849abb3e1d9b43d607b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/14/2024 3:15:19 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.3.11.9

File size:
3.3 MB (3,413,960 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://smile-files.com (C) 2014

Original file name:
SmileFiles.exe

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\sbs_ve_ambr_20170211100736.001_ 313

Digital Signature
Signed by:
Webitar Production Inc

Authority:
DigiCert Inc

Valid from:
11/11/2014 1:00:00 AM

Valid to:
11/15/2017 1:00:00 PM

Subject:
CN=Webitar Production Inc, O=Webitar Production Inc, L=Mahe, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0F9F8704E151CAFCFEFEECFBBA733C63

File PE Metadata
Compilation timestamp:
1/23/2015 11:56:09 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x496F20

Entry point:
60, E9, FE, A1, CF, FF, 29, FE, 8B, 3C, 8B, 66, FF, CE, 5E, 01, C7, 66, 0F, BE, F3, 8B, 75, 0C, 8D, 64, 24, 20, E8, 88, 5F, CF, FF, FF, 34, 24, E8, 6D, 3D, CF, FF, 34, 1B, AF, 1A, E8, 39, D2, 08, 1E, DC, 4D, 40, 02, 19, 8D, 4C, F2, 84, 6E, D3, 05, 85, DE, C1, 74, 07, F9, 32, F0, 6B, B6, B0, 9B, 41, 1E, F2, 2B, 91, 08, 42, F4, 20, A5, 59, C8, 2C, C9, 5B, 86, 32, DB, D4, F3, EC, 95, F4, D3, AA, 6B, 84, 35, CF, 78, 32, BC, 65, 62, 1B, B3, 9E, 38, 7E, 61, A2, 45, A7, 23, A1, 68, EA, 23, 34, 94, E4, CA, AC, 88...
 
[+]

Packer / compiler:
ASProtect v1.1, 0xBRS

Code size:
932 KB (954,368 bytes)

Remove sbs_ve_ambr_20170211100736.001_ 313 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.