home

screenshotsmaker.exe

SmartSearch

LLC

The application screenshotsmaker.exe by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from sendme13.ru.
Publisher:
Artex Management S. A.  (signed by LLC )

Product:
SmartSearch

Version:
1.0.1.0

MD5:
f21faaddf45dbe7e24bed8a555d329d3

SHA-1:
133bdd4aecc81024a3a65eef4446850467bdf1d8

SHA-256:
80a412fa618539468c1675f8575afde2b70e1194561c2b9995357d1e1480806b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/15/2024 9:52:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Amonitize.ArtexManagementSA (M)
15.11.6.19

File size:
4.6 MB (4,856,824 bytes)

Product version:
1.0.1.0

Copyright:
Artex Management S. A. 2015

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\screenshotsmaker\screenshotsmaker.exe

Digital Signature
Signed by:
LLC

Authority:
COMODO CA Limited

Valid from:
10/1/2015 3:00:00 AM

Valid to:
10/1/2016 2:59:59 AM

Subject:
CN="LLC ""AZ SOFT""", O="LLC ""AZ SOFT""", STREET="Vulytsya Dalnytska, Budynok 23/4, Ofis 310", L=Odesa, S=Odeska, PostalCode=65005, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3CCA67117AE7C5BE2F99ECBA3ECC9F69

File PE Metadata
Compilation timestamp:
11/6/2015 5:00:27 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:6IjAXOJDu3SPuoBiS4tPvWEypXWttkLKy8HnD05TMus7WmfWH1w8nyfuaWf+T:f8XOECPuvWEypXWDmK/D0iusxfWW8xlA

Entry address:
0x34E770

Entry point:
55, 8B, EC, 83, C4, E4, 33, C0, 89, 45, E4, 89, 45, E8, 89, 45, EC, B8, D4, 0C, 74, 00, E8, 1D, 16, CC, FF, 33, C0, 55, 68, 3C, E8, 74, 00, 64, FF, 30, 64, 89, 20, E8, AE, 86, CB, FF, 85, C0, 75, 30, E8, 01, 40, F2, FF, 84, C0, 75, 20, 8D, 55, EC, 33, C0, E8, F7, 86, CB, FF, 8B, 45, EC, 33, D2, E8, 89, 40, F2, FF, A1, 34, B3, 75, 00, 8B, 00, E8, E9, 81, EA, FF, E8, 80, 24, FF, FF, EB, 4F, 8D, 55, E8, B8, 01, 00, 00, 00, E8, CD, 86, CB, FF, 8B, 45, E8, BA, 54, E8, 74, 00, E8, 10, CD, CB, FF, 75, 2E, E8, B5...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
3.3 MB (3,463,168 bytes)

The file screenshotsmaker.exe has been seen being distributed by the following URL.

http://sendme13.ru/.../88e217f2ef5b88041bf412c3160ae958.exe

Remove screenshotsmaker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.