» setup_gmsd_us.exe
Overview
Analysis
File Details
Downloads (1)

setup_gmsd_us.exe

TUTO4PC COM INTERNATIONAL SL

This is the Eorezo installer which may include software offers for unwanted programs including toolbars. The application setup_gmsd_us.exe by TUTO4PC COM INTERNATIONAL SL has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dl.gruscanadensis.com.

File name:

setup_gmsd_us.exe

Publisher:

TUTO4PC COM INTERNATIONAL SL (signed and verified)

MD5:

0f583f74dd432d5ed72a0d42269305fa

SHA-1:

9a9fb756b0f61f64504b9e4058847c45f8be7794

SHA-256:

1346b927b0288d38998154a98f256a96d6465c0b2985f6f18cb70e9832e25821

Scanner detections:

21 / 68

Status:

Adware

Analysis date:

11/15/2024 5:54:53 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Eorezo.CD

708

AhnLab V3 Security

Win-PUP/EoRezo

2015.02.24

Avira AntiVirus

Adware/EoRezo.bonc

7.11.212.42

avast!

Win32:Adware-ASG [PUP]

2014.9-150226

AVG

Generic

2016.0.3186

Baidu Antivirus

Adware.Win32.EoRezo

4.0.3.15226

Bitdefender

Adware.Eorezo.CD

1.0.20.285

Dr.Web

Adware.Eorezo.31

9.0.1.057

Emsisoft Anti-Malware

Adware.Eorezo.CD

8.15.02.26.12

ESET NOD32

Win32/AdWare.EoRezo.AU (variant)

9.11221

F-Prot

W32/S-c61ac5f0

v6.4.7.1.166

F-Secure

Adware.Eorezo.CD

11.2015-26-02_5

G Data

Adware.Eorezo.CD

15.2.25

K7 AntiVirus

Adware

13.198.15057

Malwarebytes

PUP.Optional.Tuto4PC.A

v2015.02.26.12

MicroWorld eScan

Adware.Eorezo.CD

16.0.0.171

NANO AntiVirus

Trojan.Win32.DownLoader11.dnwzcn

0.30.0.296

nProtect

Adware.Eorezo.CD

15.02.23.01

Reason Heuristics

PUP.Installer.Eorezo

15.2.26.12

Sophos

EoRezo Adware

4.98

VIPRE Antivirus

Tuto4PC

37832

File size:

3.2 MB (3,376,424 bytes)

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\6jgreftj\setup_gmsd_us.exe

Digital Signature

Signed by:

TUTO4PC COM INTERNATIONAL SL

Authority:

GlobalSign nv-sa

Valid from:

6/3/2014 4:55:26 AM

Valid to:

7/28/2015 8:19:10 AM

Subject:

E=contact@tutoriales100.com, CN=TUTO4PC COM INTERNATIONAL SL, O=TUTO4PC COM INTERNATIONAL SL, L=BARCELONA, C=ES

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C8382D4ADA7C0F9495915A4D5B4D8C97

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:r9RP7XaOUKaEx9QOrUOY4cqAIS/hCfwgY0yXaW7Lnt3dZF60iNyitMjHT:xVbaOUKaEx9QOwODrIiFW7Lnt3Coit

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9982

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file setup_gmsd_us.exe has been seen being distributed by the following URL.

http://dl.gruscanadensis.com/download/trasgo/clickmein/.../setup_gmsd_us.exe

Remove setup_gmsd_us.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.