home

sia elastic heart (karaoke_instrumental).mp3.exe

The application sia elastic heart (karaoke_instrumental).mp3.exe has been detected as a potentially unwanted program by 24 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from pfs.ezdownloadpro.info and multiple other hosts a known adware distribution point operated by Rafael Leviev.
MD5:
fe1be9a708a1ff9bd511b76af4dff6b1

SHA-1:
5a3031652faa008fe55afd8ebbf7509d5765fe8c

SHA-256:
ac4a9513658e38ea9598032afbc302e6245431edc4cda7c396d43ee71d961fb7

Scanner detections:
24 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 8:23:59 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
6542235

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.03.18

Avira AntiVirus
ADWARE/MultiPlug.Gen
7.11.218.52

AVG
PSW.Generic12
2016.0.3167

Bitdefender
Gen:Variant.Adware.Mikey.8516
1.0.20.385

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
21448

Dr.Web
Trojan.DownLoader12.34388
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.FG application
7.0.302.0

F-Prot
W32/MultiPlug.H.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey
5.13.68

G Data
Gen:Variant.Adware.Mikey.8516
15.3.25

IKARUS anti.virus
not-a-virus:AdWare.MultiPlug
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.201.15295

Malwarebytes
PUP.Optional.Unizeto
v2015.03.18.07

McAfee
Trojan.PWS-Zbot.gen.ep
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
16.0.0.231

NANO AntiVirus
Riskware.Win32.MultiPlug.doojhs
0.30.8.659

Panda Antivirus
Generic Suspicious
15.03.18.07

Reason Heuristics
Threat.Win.Reputation.IMP
15.3.18.7

Rising Antivirus
PE:AdWare.Win32.MultiPlug.s!1075356738
23.00.65.15316

Sophos
PUA 'MultiPlug' (of type Adware)
5.12

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

Zillya! Antivirus
Adware.MultiPlug.Win32.225846
2.0.0.2104

File size:
1 MB (1,077,760 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\ProgramData\{6bbc5c76-f1a2-76e9-6bbc-c5c76f1a71db}\sia elastic heart (karaoke_instrumental).mp3.exe

File PE Metadata
Compilation timestamp:
5/15/2013 2:35:28 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:/40dA8Sd+rjmPwoWAKemI57rPZlI/M2hkhJ9:fJ0woWAK1SPrgkhJ

Entry address:
0xDFF02

Entry point:
E8, DF, 14, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, E0, 2E, 4F, 00, E8, E8, 19, 00, 00, E8, AC, 16, 00, 00, 0F, B7, F0, 6A, 02, E8, 72, 14, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, E8, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
914.5 KB (936,448 bytes)

The file sia elastic heart (karaoke_instrumental).mp3.exe has been seen being distributed by the following 2 URLs.

http://pfs.ezdownloadpro.info/hp/?q=paPur3Fy13hRJsfZTVehV2Au1J5DrjxcXGnzPaGQbRUrOZBNmFu3q5z57zWuYEXQNOkw1AC8XVskosByO663ycO26Wg0HZQbT7 4pmRQN7HjOftBPeSD41uIIiLL8KfWxjY1bWmY0Aw5T7mzCE48pgqHcKgAAYKsKbmU5wnhXcl0Clwz8aDG8QqP4fo6zgKt9Qunp5QCbVd5STeL5hDeJKWQmsxiaiuyPJuQ0v87HZRamSzWZ2JG36tmH5R2NczTu4xFfdUqobyqP 6mzQGYGy0SPXb3H1M46Gu9jUM8JWJRBGAjGaQi/6KPnFLjXrHyxaoCsJDp8wl4He5zCT9eIutUa 9Yf V62efRrsnj7OKw6Vx6 mphM23dP9EyfICCuhEhcqbGVgO7q0KmiV0Slzv1JSrGf/lY3XKuYqell873GN/ULWbFY uNptdJmGKLJNUx11ypJ eT /.../YO&uuid=YLOlBxsb0ILJ664wMkWaYGIqI4Hj97I5lNrURUysRjw1j1td8PWZT1uRPQXa0otZaZO2yXphQAZXqhjcLhhac8Pu3mnu9qt0FxGXCU1pD38yJ0TzYl21VpcxxD7FwyprvadgxrCFLESJTjEsHY5hfV6ZwOy7E4wGeQS5LwtFeuLoQH8BVDWjMvySjZQnt2nX5ioAnhvBR49Ngy4rZRvJoFC6fDFogglhB6RIwqQOJdeFkSz5jVSrIzBxU8ZUdadz85Jnk6OrgAGa4PufgAVHrhcrJxy1q2t0M9n3VAZYbflJ0dSlFNMgAkhsd4UuVy46BRhGpcU4rS5st9TaqtisWmVMOw4fQo5Px8rkm1AsHUlDLcm5oYbkKAs75yYg2PCyI7hLxrF6gXdzqG3V8Rd3nOON

http://pfs.ezdownloadpro.info/hp/?q=UCFigTfC2lfZ2vqomj3NoVsFPEi1J3mTvStVvaqmFJxk7JtT2Ljv4ic4otWjF/mC8258K9f6LvJEhRZ0jOjtMxYzCWqZHf2hgHGshEjZAxO9N4k/4o3ycoPJYjFsasLOrGK2Og7FTh5/m4xA4Iej113U6ivv5NmDeCuKwklIq4nOVODpI/rVtZZ7zJhaktl5k1R5cNmRCSXqIJsBhpOdKc4pz1wqV 19ESwaMASLJIGlZw7DjlkWVY /8uloGIE2h5uTu5hUDhMtg2QI/AQLb8Qa4b22KQ2Tvxaw c8oj8ylcqIPsfEO3g/LxlVsEry6jevVPFntn3CUuzirsxQcF HbR4QQHhl/GavH/Sp YQYWviZZdmbYMF IIHLzjNfLGNQI TGIgCCZyaowbfzdqbO8T/VKUVyZ3 A4RVElfkKSQ5ZFv5XaQfgiP1p71Nibgcdh8orALiTvqqEQoTNmTrljTuVat9FpYlad1BkqjpCqSM 3bGdBOpXyNT3M9lILTo/ogs9iQ4Ct 3y9ycvIKxtTlbjxEa25s 3MzfmbImRAfnPWHH9k/QOitDrCoRTks 0VK1JZsh26c6HyvOuGown92kVl6O9U1W5JlN2Zu6/kgxkgjdacS933VQHIDqEipyXzWq0QjqaMe/.../dPMCxcFEgrArAzEnNHlJTGn7q5FghvE7mveZzNA SJTReC f46PzXy9 GRMPkWFJtnxVu7Q3jCYDDlQ4R svsRuXgPkuVcHJl9v4a7NZwM 3uEGM1nj9EUBteQcODjO4P41eP73k1A4oShwNC Jkommxlt5djOopLOfrKdxO5QOelU

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.