home

spotify.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application spotify.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.todaysendsoftware.com and multiple other hosts.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
d8be962d1a2a727f9d50ef2c1b086d20

SHA-1:
37f138d77221923d00b30b231629e9bfa64dbc49

SHA-256:
7125d8c882fdce634814b002604d40f18eb313162f463d53c55cca2881db3932

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 3:33:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.16.2

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\spotify.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:30:20 PM

Valid to:
6/1/2016 5:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:uQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:uQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file spotify.exe has been seen being distributed by the following 19 URLs.

http://www.todaysendsoftware.com/.../2U0qsNS4jk3 U2I5Q3h5kxaSCvSaeQ7iigbVFZSXFdqAooWrTB7VTn4KY5MsOPi09T2jhfiLYf4GnkZX&e=0&downloadAs=Spotify.exe

http://www.capitalvaultsbits.com/WVl6OTRQVVZVVFhOVE4wRTVOSHBGWVdsWE5FZFlXalIyTXpoS1RHbEJZM3BTVEVkSVQxQlVjMkY0TXpCeUpUSkNRU1V6UkNaalBYSjBSMGx5SlRKQ1lVOUlhMjVTTTA5SlFsVXpOR3BCVlVWWU1XZHJiR2R1Y1RoWFlsRk9abXd5UWpOSU1ISmFVV1I0TUd4dlYwMXBaa2gzUzNGUlVqWkVPREI1UjFKSWIwdHphWE0yVDNwcGRVaEtWbXRFV20xSU0ycHNkMjVxUTNKM1lVSXpNbUpMVjFsaU4xaGtjamRFYkdWWk9YUjNSWGdsTWtJNWFGaDJhV0l4SlRKR0ptUnZkMjVzYjJGa1FYTTlVM0J2ZEdsbWVTNWxlR1U9

http://www.todaysendsoftware.com/c?x=6NPZpLzoRvyuE26Wi9afj0dgE/v1r9daOiNMMxvBai0=&c=8ipk739oGDGjJVD4lN4JwhJ7ZxagDf/Moy51U1QZoVran/7Ilu99zN67HzJ6DNuUORKC6Ko6WtKmeJJD39tmR1X4Dv/d/.../kF4rP0A57m TGRtC09BUG2oHRb6F7qi4FAhE89EVyM9ejWrCpMYDGMVHDpuPk=&e=0&downloadAs=Spotify.exe

http://www.todaysendsoftware.com/c?x=QM96JWc0XnzpHTdREOs2cnSVz2hlrc0hK8tyS1xU Kc=&c=4cKYIKrN3cR yxnIa0k/vDGqFXgoVww3UJjYNIg8Tr1OmRSF0klWkE8zMgss6aqDqoj39 noaV8ND5o/.../CdDHhHC9v9tM8Z5LqOnKpAKAug12kjNhiJsEDe5ulAXoJOkW1JuHOZpvPAgb0fNAUWuAp7 jPPHbPK3s&e=0&downloadAs=Spotify.exe

http://www.capitalvaultsbits.com/WVl6OTRQVlJVVlZFNGMxZzFibmxVU0RaWU5FOUxWMVIzUlVNMVJtNGxNa0kyWkZkWlpESkZRMjAyZGpaeFRUWnNSU1V6UkNaalBYaFFhU1V5UW1rbE1rWlhUREV6YVRSV1duWnlSa1JGV1ZwdU9EUjZWSEJsVnpkcGFsbzRUMk4wTlhodVJWUmljVEpETVZKbVZ6bDRUbWRUU1Vrd05rVkxhMVpKZVRKMGJ6RmFha1ptVWxNNGJHOTNiRE56TnpGU1VrcHlZbVJSYTJaSkpUSkdkVzVNZWtoNlEwTmFUVkpMZW1sMmNuRjJjbXhsZURkU2EzSTNTbXRPYVRsUUptUnZkMjVzYjJGa1FYTTlVM0J2ZEdsbWVTNWxlR1U9

http://www.capitalvaultsbits.com/WVl6OTRQVVo0VG5WWlFucFNVakJEU3pVMlRuZE5KVEpHV1VJMmVVZG5XbXRETUVSc01sVTRaMnAxZG5obVkxRXdNQ1V6UkNaalBWVkZOME0xUzFCQ2VESkdabEoxYmpReFIyTlZUVEl3YWtWTVZGSnBkMWxaTlRWRVpXVjBjVkZ2YUhkMFlqWktURGxOTVVsWU4xZHpNRVZSUzBOa1VHSTNjRGMyUkZaQlkyZExVVWxOYjBKVVUwZDNKVEpDUWtneFJtZEdSRGRKYWpaUmNFaGhWa2s1VUVsMFJHWnhSMlJYVUd4d2VHeEdTRTAyVkRreFNFZHlOMlVtWkc5M2JteHZZV1JCY3oxVGNHOTBhV1o1TG1WNFpRPT0=

http://www.capitalvaultsbits.com/WVl6OTRQVUZ5TlVWMldIWTRTVEJwY1RjeGRIQkdiSFZCWmpOTk9EZEpaak0zUmxoRU5Wb2xNa1kxU0ZZMVUzQlpRU1V6UkNaalBYVmlhVGR1V1Roa1VISnlkV3hQUldOeGVtTjFlVWRJVENVeVJrOVdTakpNZHlVeVFreFdOVTF5WTBzd2RVbEZlbFptTkZOV1lrTjZXalZOWVdRbE1rWnNOeVV5UmtVbE1rSjBjMnBQWWtrNFlVWWxNa1p4WTJvMmNXUjNibGQ2TW05eFdHc3pWMWhKUVRGc1N6TWxNa0l5TVdSMk1YUkJPRE5SV21wNE9YbHlVV1ZOUTJnMWExSTBSME0xVldjbVpHOTNibXh2WVdSQmN6MVRjRzkwYVdaNUxtVjRaUT09

http://www.guardquickbyte.com/c?x=gAX7PYiVSqNef6WMPLuo/hLRXshuzsADW9Yu/XO5nEk=&c=s4hPKZguzyIXx6XBtkWjFXa4YlvFUWfPrmnW//.../oQ0AmfmnQl4qBiiIGztK7AYUUtdrrKQKTXzdsA7kYLDkoK4oRMuA6OFWPPsqwtHha8KbXyxFyhVZszumt4cMC5YyuFJZ7p1o=&e=0&downloadAs=Spotify.exe

http://www.todaysendsoftware.com/c?x=CiPHa8 c3u9StvtMNlAbHsMhF0x6Jj/k4anZM7VrMBc=&c= PibfqS5vzcRfQyv/vsUSeOZwfw3GXQKfvJNaDQx 60u3VY36ucC/.../sraFGqS1oOFq49KGl3ID pLM8Gx8yeoM9LR1nKZzZQYRLkogk6EgdhPnJDhqjXatD1oJBtttbfyc5tRsBcZyEtVKi34Oq zmgsK5cJRT8AEcE=&e=0&downloadAs=Spotify.exe

http://www.capitalvaultsbits.com/WVl6OTRQVFl3WVNVeVFuUkRKVEpDV2tGUWExVWxNa1p4UldnMVdGaHNNV3R0YmpkQlZVSm5jVFJSVjFVbE1rSkxhMjlXV2xGU1NTVXpSQ1pqUFV0Q2JITTBlRGRYY2xCYVQwSk1XazAwU0ZrNE9IWnBiemhUVDNCM1RFOTBOa1JhZDJKamVsbEZWRlZEVWxONE5qSXdlV1JpZVVOVVJIVjVNbWN3UlV0WWRHRkhiMGhOZVdGc1oyZ2xNa0psYjJKNE0yMDBiMHN4TW1ka05HZE9jbWhtVm1aME4zSkRXamRaY0hGM1EyTkhkVTB4ZVV0TVlsVm9TSEpSZG5WNWRHOG1aRzkzYm14dllXUkJjejFUY0c5MGFXWjVMbVY0WlE9PQ==

http://www.todaysendsoftware.com/c?x=ndRfGpgsg/icQcDfRi/LC5KdO90NKYdjPnhV9zz0KXU=&c=jxkqH2LE9ONE7BUvke2t/4tRBhYzQAzIlS4Nu3e8XD wtJdklInMfM7MTTkNQhRuf3ZB3jBsz0qY98KxnUZ9EjA6qToIPC6g7uPLC5hg 4hyL2qsU/gCf8mxBw/WgY7uVKVL3Pblt2tCVa8u0ZjyX hPol88iZ6Y0VUOtAQ1RfYJnmOfXCs1jn/.../5XemX4&e=0&downloadAs=Spotify.exe

http://www.capitalvaultsbits.com/WVl6OTRQWGRPUjNka2JFUXdNakEzYldabk1XdENOMHA1TUd0Mk9HeFdZM0l3ZFVNM2NVWmpaRUpwUVRSTU1UQWxNMFFtWXoxdGNXY3hSRmRUTlc1UFlUUlRWbEprUW1oMmFWRmhSelJGWkRoSFNqY3lOV1ptSlRKR2MwNHpNbkJyTUV0MFRqVjZjVmRHZDFnelQwWXljemRZTm1ZMWQyMUVUVGg0WkRVek4wTWxNa0pHZDFGQ2QxbDVTbmt4YVc1NGJGZHlVWEV6WW1WNFNWUnpSMDlUSlRKQ2RFdElibEIxYW1SNU5tVXlhVEZVVTJOUk5XcHhNSGRuY1Naa2IzZHViRzloWkVGelBWTndiM1JwWm5rdVpYaGw=

http://www.capitalvaultsbits.com/WVl6OTRQWEIyUzJjMmNqQTVabVZ5U2pjMmJXTXdiMnBsTTFsd2VHVlVRVWd5YTAweFFsZHpSMUprWjB0YVFXOGxNMFFtWXoxa1JFUmtWME40Tm1OR1MzWnFlRWh0Vm5GUlIyMU5ZV3RCUlhVMWJsUXpOVXhhVkVaWVJtaExhMFJsVURCd2R6WWxNa0lsTWtJNE5rcE9WMHQyT0d4Qk1IbGxjRUkzY1VFd1EwZFhTalUyWVdWdldIaGFlRUUwY2lVeVJrSTVkblpwVm1rd2NqVk5KVEpHUm5CMmVUZGtka05tZVd4TGFXVkJZeVV5Um5aMU1FRnhOMDFrVkU5M1RIQW1aRzkzYm14dllXUkJjejFUY0c5MGFXWjVMbVY0WlE9PQ==

http://www.todaysendsoftware.com/.../ LYFLkjIscqC7seuNCF5Jx&e=0&downloadAs=Spotify.exe

http://www.capitalvaultsbits.com/WVl6OTRQVVZKVVdRd1pERkNVbXRsYjNZbE1rWXhObFZDV1UxbFpWWlNTV296Y0RsRFYwTmthVGh3ZW5OUVVWaFdPQ1V6UkNaalBXMXdlVVkwYWxOd1V6aHZhVWxUWjJaNmRsRlRWRzF2UVZCMVVqUTBiV2g1YlhCa0pUSkNNR2d6UjJ0dmREQkhjalJRYUZKRFQxWk1XR3ROUWpKVU1HeG1aRzlRUm05c016QmhKVEpDVVROSFdqQk1XamxRVGtKNFFqQTRibE5HYzFCM1FqVm1RbFJvVkc5U1ZFTjJSbmx0U1U5clVteEZUbVJTY1dkb2EyeEVVVlZ4UWlaa2IzZHViRzloWkVGelBWTndiM1JwWm5rdVpYaGw=

http://www.capitalvaultsbits.com/WVl6OTRQVzQ0U0RkUk0yaFFPRmhFU1hSNFUxaDVNbTVKWXpKTFdUUnVaV1oyVjBjM00wZzNZV1Z3V25Od09EZ2xNMFFtWXoxd1pGTnljV0pQU1ZoWVozQjRhek5sWjJwb1RtMXVUR1ExVUZWUFNEQTFRWEZFVEdsa1ExVndSbk5FY0hGVlNrWkJKVEpDWmtKdFUyRkxkVzlyUWtwdFoxRkxTRmR5SlRKR1lXRWxNa1pUYlVnMGF6SklObWxZT1ZwRllYaHRTVFpGZDI5U1NUa2xNa0l3U2xCemRUUlhSVFkzSlRKQ1ozcGtVM2g2U1dnelpVNVlTakZzVFhoU1NVSW1aRzkzYm14dllXUkJjejFUY0c5MGFXWjVMbVY0WlE9PQ==

http://www.capitalvaultsbits.com/WVl6OTRQVGt6T1Zkb1Z5VXlRa1ozWW5RNVF6TlNURXhQWm5KcmJsVmtlVTFHUlZGRldWbEVWV3REZERWNVUzSllSU1V6UkNaalBWbHhORGxMUjB0d1dYVm5hVEpaUm1oSFoybGxWWGt3U2pJM00yOVdPR2RGVGxreFZucEhNVVJCV1hSMldYRldVakpQVEZZeWIxcFJWV3c0TUZWTFpGRnVRV2xWYW1GU1YwaE5Zak5xZDJkWWJsTkZOek0xZGtOamFHTk5KVEpDYXpOV1ZHeE9iR2hrTWxKWFVtUnhjMGxwTkRKSFowUmFPVkUyYVdGNVV6Wk1WRGdtWkc5M2JteHZZV1JCY3oxVGNHOTBhV1o1TG1WNFpRPT0=

http://www.capitalvaultsbits.com/WVl6OTRQVTRsTWtaekpUSkNObWhEY1RGNFVWSTVOM1JITVhkM1NUQjZkWGQwSlRKR2RtMVNOM0IzZWt4cE0zRkRkVmxvU1c4bE0wUW1ZejFXY0dWSU1HbEdZV1JDWkZWbmFVSmFSak5LUVhKMFZpVXlRbGhVVkdOMGJWTkJWSFZZWTFKbVVIaFBKVEpDWW1kMGNGQk1aR0pUTmpaS00xcFhTVmd3Y0dab1pqSndURFpZVW5oRmVXNDNZbVp5SlRKR1JWZEZlbEp6TUhOTFJFcGpka3RrUWpOTE0zcERZVm80TldZM1MxRXdla3dsTWtaSlMwWXpXQ1V5UW10VGNHZHRaa2g0VFdFbVpHOTNibXh2WVdSQmN6MVRjRzkwYVdaNUxtVjRaUT09

http://www.todaysendsoftware.com/c?x=wdY0W9UPpzw9nbh0HeFarn9TLth 6IhliauAumzhtew=&c=yYtb2rC31Y cAwGww1plEaWDAFSPT YCXMbifFKZu4k2IYkGbMiPxaZCwjyGdzgO1Ai1oWkY4y/9xS04t4FPSDcU0roULBQMo7ew/gZp2zzpJWI8756lOYXkoew35QyWRtc 9F2Aq/.../8OJnfDWEBnO30m38Eb6T3nrpKQGf5H5BzS&e=0&downloadAs=Spotify.exe

Remove spotify.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.