super mario forever by eray2010.exe

Conduit Ltd.

The file belongs to the Conduit API platform, a utility that bundles and monetizes search toolbars and web browser extensions. The application super mario forever by eray2010.exe, “Mario_Forever Toolbar” by Conduit has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Wise Installer installer. The file has been seen being downloaded from dc402.4shared.com. While running, it connects to the Internet address cms.distributionengine.conduit-services.com on port 80 using the HTTP protocol.
Publisher:
Conduit  (signed by Conduit Ltd.)

Description:
Mario_Forever Toolbar

Version:
5.6.0.23

MD5:
a19f118cf1fd84efc94bda46e40a9dc4

SHA-1:
d2a934eeb9a6a801e088b8c3543ba75b48787c23

SHA-256:
7cadac1909a8881a763ff2449378172841e470f5d1f064aa29f35f69cd3a55f9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
This component is distributed and installed with the Conduit Toolbar platform.

Analysis date:
11/23/2024 12:16:09 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Conduit.Installer (M)
16.6.8.20

File size:
1.7 MB (1,797,968 bytes)

Copyright:
Conduit Ltd.

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

Common path:
C:\users\{user}\downloads\super mario forever by eray2010.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
2/17/2010 8:00:00 AM

Valid to:
3/30/2013 7:59:59 AM

Subject:
CN=Conduit Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Conduit Ltd., S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3736DA15AF647632CCE61CD41B6577DD

File PE Metadata
Compilation timestamp:
4/9/1999 4:24:47 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:Dk+ECIAQ9D4vE8uUr/9pisUe+0bYe47az:ImxQ9DTWr/9pisQ0bYeGs

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 78, 05, 00, 00, 53, 56, BE, 04, 01, 00, 00, 57, 8D, 85, 94, FD, FF, FF, 56, 33, DB, 50, 53, FF, 15, 34, 20, 40, 00, 8D, 85, 94, FD, FF, FF, 56, 50, 8D, 85, 94, FD, FF, FF, 50, FF, 15, 30, 20, 40, 00, 8B, 3D, 2C, 20, 40, 00, 53, 53, 6A, 03, 53, 6A, 01, 8D, 85, 94, FD, FF, FF, 68, 00, 00, 00, 80, 50, FF, D7, 83, F8, FF, 89, 45, FC, 0F, 84, 7B, 01, 00, 00, 8D, 85, 90, FC, FF, FF, 50, 56, FF, 15, 28, 20, 40, 00, 8D, 85, 98, FE, FF, FF, 50, 53, 8D, 85, 90, FC, FF, FF, 68, 10, 30, 40, 00, 50...
 
[+]

Entropy:
7.9961

Packer / compiler:
Wise Installer Stub

Code size:
512 Bytes (512 bytes)

The file super mario forever by eray2010.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

 
http://offering.service.distributionengine.conduit-services.com/DecisionEngine.ashx

TCP (HTTP):
Connects to cms.distributionengine.conduit-services.com  (54.243.251.51:80)

Remove super mario forever by eray2010.exe - Powered by Reason Core Security