home

The A MEDIA

Publisher Information

The A MEDIA is a software developer located in GuroGU, Seoul in Korea*. The publisher primarily developes software that can be classified as adware. There is one additional code signing certificate issued to this publisher.
Authority:
VeriSign, Inc.

Valid from:
5/16/2014 9:00:00 AM

Valid to:
7/15/2017 8:59:59 AM

Subject:
CN=The A MEDIA, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=The A MEDIA, L=GuroGU, S=SEOUL, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6cba74d61bd6e1976aa4fc95686cb89b

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.TheAMEDIA.Toolbar (M), PUP.TheAMEDIA.Installer (M), PUP.TheAMEDIA (M), PUP.TheAMEDI (M), PUP.TheAMEDI.Toolbar (M), PUP (M)
100.00%

Malwarebytes
Adware.Winggo.K, Adware.WingGo.K, Adware.OnOffPop
16.00%

Bkav FE
W32.HfsAdware
14.00%

ESET NOD32
Win32/Adware.WiseMop (variant), Win32/Adware.Winggo.AD (variant)
14.00%

Dr.Web
Trojan.Adkor.122, Trojan.Click.origin, Trojan.Adkor.237
14.00%

AhnLab V3 Security
PUP/Win32.MWManager, PUP/Win32.IntClient
14.00%

Trend Micro House Call
ADW_KRADDARE, Suspicious_GEN.F47V0917, Suspicious_GEN.F47V0126, TROJ_GEN.R00GC0OC515, TROJ_GEN.R0C1C0OBA15, Suspicious_GEN.F47V0125
12.00%

IKARUS anti.virus
Win32.SuspectCrc, Trojan-Downloader.Win32.Banload, PUA.WiseMop, Trojan-Banker.Win32.Banker, AdWare.Win32.Wingo
12.00%

Comodo Security
ApplicUnwnt
10.00%

Qihoo 360 Security
HEUR/QVM37.0.Malware.Gen, Malware.QVM17.Gen, Win32/Virus.Adware.3c9, Win32/Virus.Adware.8f9, HEUR/QVM10.1.Malware.Gen
10.00%

1 / 68      (PUP)
MWMToolbar.dll  (a0eec8281faa7e3facec9517c2dfda5f)

1 / 68      (PUP)
mwmanagers.exe  (c01748ea655133a2043ff6e58023b171)

1 / 68      (PUP)
mwmanagerm.dll  (d2ca3a621e52a12417bf5ad251c6c492)

1 / 68      (PUP)
onoffpop.exe  (af89b661fe39e9f7795720b939316c25)

1 / 68      (PUP)
MWManager.exe  (55b860f6e3f51a059d11708e80c5a48c)

1 / 68      (PUP)
mwmanager_utiltop44.exe  (107fa07883a4d3101747590b43dd51cd)

1 / 68      (PUP)
onoffpop.exe  (4199482363c4507f94a2029801df05a7)

1 / 68      (PUP)
MWManager.exe  (d6a120b9c8d360290fd33e75062f7518)

1 / 68      (PUP)
mwmanagerm.dll  (c5d9eeccc8e351a227dd46b42948459d)

1 / 68      (PUP)
MWManager.exe  (6920857b884bbfa2127164ad7b1677a9)

1 / 68      (PUP)
mwmanager_utilbada.exe  (c2e4109133377a19c3c954e586e62277)

1 / 68      (PUP)
MWMToolbar.dll  (6836d1851858a141561edc6ef41be1bf)

1 / 68      (PUP)
MWManager.exe  (908893e5743a62411659ee0c611c3b25)

1 / 68      (PUP)
mwmanagerm.dll  (452055b53d01c254d3828e55799dbf42)

1 / 68      (PUP)
mwmanager.000  (0d97d3ec8f59f4b8cb3bba2264ca4bb2)

1 / 68      (PUP)
mwmtoolbar.bak  (c287b496d492954f6ae1c113ab073000)

1 / 68      (PUP)
ts.dll  (e5184678706beb0994a8af269fcd128f)

1 / 68      (PUP)
rmo2.exe  (d6a72a5eba767e622715318f2cce7a07)

1 / 68      (PUP)
o2sch.exe  (711b5fb57a9c73c805d5f95fdae52cb7)

1 / 68      (PUP)
onoffpop.exe  (af89b661fe39e9f7795720b939316c25)

1 / 68      (PUP)
mwmanagerm.dll  (47e8c2a57be2b8f02ce334c54e314d6e)

1 / 68      (PUP)
mwmanagerm.dll  (ba2e4f2b29f2e1852a9d5d4e22f00319)

1 / 68      (PUP)
mwmanager_jmos.exe  (cbd8cef4840fde6f1842a081915e80c3)

1 / 68      (PUP)
mwmanagerm.dll  (9e99520926eec1ad95341383f24bbffc)

1 / 68      (PUP)
rmo2.exe  (ab379d4567d01e2125f3b0ee9659b982)

1 / 68      (PUP)
o2sch.exe  (d6d3106e06681da454296aa747aecd0c)

1 / 68      (PUP)
MWManager.exe  (699b60ea80829bf6c7bc7249b33861d7)

1 / 68      (PUP)
mwmanager.000  (5ae00cdf18a65189e8e91f7e16dfc3c2)

1 / 68      (PUP)
mwmanagerm.dll  (77656b3e92bf149f2e09f5281299aae1)

1 / 68      (PUP)
mwmanager_jmos.exe  (461c417706304fa1171e6973c1f59131)

 
Latest 30 of 61 files

The following certificate is also signed by The A MEDIA.

23374752FD9FE165B2E79B765D57B1EC  (May 15, 2011 to May 15, 2014)

The following publishers (by Authenticode signature organization name) are related.

wisemop Inc.

* Note, the details and description above are based on the code signing digital signature issued to The A MEDIA by VeriSign, Inc. on May 16, 2014 with the serial number '6cba74d61bd6e1976aa4fc95686cb89b'.
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.