home

teenage+mutant+ninja+turtles+.exe

Andrey Hmelnikov

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application teenage+mutant+ninja+turtles+.exe by Andrey Hmelnikov has been detected as adware by 26 anti-malware scanners. This is a setup program which is used to install the application. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.
Publisher:
Andrey Hmelnikov  (signed and verified)

MD5:
6944d1e399f7bca42a5f3490cf1c304a

SHA-1:
9fa8548e2245b6c89e50f6950172b52bc56e52d1

SHA-256:
83cd4fd31fc0df1349086b7671b7c2dd774582381ad4f18fbc78d8cc69ea68ca

Scanner detections:
26 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
12/28/2024 11:37:40 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.481287
6360186

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.01.03

Avira AntiVirus
ADWARE/MultiPlug.Gen7
7.11.199.42

avast!
Win32:MultiPlug-JU [PUP]
150101-1

AVG
Adware Generic_r.VD
2014.0.4253

Bitdefender
Gen:Variant.Adware.Kazy.481287
1.0.20.10

Comodo Security
Application.Win32.Multiplug.CT
20570

Dr.Web
Trojan.Crossrider.36840
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.481287
9.0.0.4799

ESET NOD32
Win32/AdWare.MultiPlug.CT application
7.0.302.0

Fortinet FortiGate
Adware/MultiPlug
1/2/2015

F-Prot
W32/A-62a286cb
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Kazy.481287
5.13.68

G Data
Gen:Variant.Adware.Kazy.481287
15.1.24

K7 AntiVirus
Unwanted-Program
13.1814525

Kaspersky
not-a-virus:AdWare.Win32.MultiPlug
15.0.0.543

Malwarebytes
PUP.Optional.MultiPlug
v2015.01.02.10

McAfee
Program.MultiPlug-FRO
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Kazy.481287
16.0.0.6

NANO AntiVirus
Riskware.Win32.MultiPlug.dfjscb
0.30.0.64448

Norman
Gen:Variant.Adware.Kazy.481287
29.12.2014 07:19:03

Panda Antivirus
Generic Suspicious
15.01.02.10

Reason Heuristics
PUP.AndreyHmelnikov.d
15.1.2.21

Sophos
PUA 'MultiPlug' (of type Adware)
5.09

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

Zillya! Antivirus
Adware.MultiPlug.Win32.95432
2.0.0.2025

File size:
880.9 KB (902,008 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\teenage+mutant+ninja+turtles+.exe

Digital Signature
Signed by:
Andrey Hmelnikov

Authority:
Unizeto Technologies S.A.

Valid from:
6/23/2014 12:25:04 AM

Valid to:
6/23/2015 12:25:04 AM

Subject:
E=Andrey.Hmelnikov@hotmail.com, CN=Andrey Hmelnikov, O=Andrey Hmelnikov, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
727B500ADD12D49F610A094EBFE02E4B

File PE Metadata
Compilation timestamp:
1/6/2012 2:59:11 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:gDkU4hlK/adlbSe3Xy3GuBrEKZJS/mhRQzeZ:EkthbdhSe3XyHBrEKAmhRNZ

Entry address:
0x3E806

Entry point:
E8, 78, 48, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, C5, 44, 00, E8, E4, 0F, 00, 00, E8, 45, 4A, 00, 00, 0F, B7, F0, 6A, 02, E8, 0B, 48, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D6, 08, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.7072  (probably packed)

Code size:
282.5 KB (289,280 bytes)

The file teenage+mutant+ninja+turtles+.exe has been seen being distributed by the following 3 URLs.

http://bestoria.info/v20412/lp/?q=tcYGAXnedsdzwomjlh5pUZybSsxRPZf1y158nlbKmoLqHcpV1ZLZcqWEGB9co8AB/OkyN3nVLcqqy8NUCn jX9uYEnUYwOrKgmsZ6yBse5 3disQXjbgsEHn8rLS0d2CMvTF/w8rX4QFSivEFB65rA0dnOmUWeIPb5kpd1nCeVPpWlovvMgjjVaWmeahpF7AAwHHB2Pdhu8krsadvWSWZwEMeZRF42yZ9PwX2qGPKfi1g/vnKDACm94UZ5nqd7DvScSprLG9XCZskTI29P/OPzn8fcfDf1VtjQtKaVHyxZXkW4mK5z7TEfokDlfqdivU1A/.../4ho3WP Dkpa Sgv8&external_id=1415236468011438501

http://bestown.info/8a6444a58b5864949c7b0ada1413b131/never_2/dl.php?id=1415236468011438501&r=http://bestoria.info/v20412/lp/?q=tcYGAXnedsdzwomjlh5pUZybSsxRPZf1y158nlbKmoLqHcpV1ZLZcqWEGB9co8AB/OkyN3nVLcqqy8NUCn jX9uYEnUYwOrKgmsZ6yBse5 3disQXjbgsEHn8rLS0d2CMvTF/w8rX4QFSivEFB65rA0dnOmUWeIPb5kpd1nCeVPpWlovvMgjjVaWmeahpF7AAwHHB2Pdhu8krsadvWSWZwEMeZRF42yZ9PwX2qGPKfi1g/vnKDACm94UZ5nqd7DvScSprLG9XCZskTI29P/OPzn8fcfDf1VtjQtKaVHyxZXkW4mK5z7TEfokDlfqdivU1A/.../4ho3WP Dkpa Sgv8&__rnd=820ebd6129e4be66ef6b7edcb03c8dfd

http://bestown.info/8a6444a58b5864949c7b0ada1413b131/never_2/dl.php?id=1415236468011438501&r=http://bestoria.info/v20412/lp/?q=tcYGAXnedsdzwomjlh5pUZybSsxRPZf1y158nlbKmoLqHcpV1ZLZcqWEGB9co8AB/OkyN3nVLcqqy8NUCn jX9uYEnUYwOrKgmsZ6yBse5 3disQXjbgsEHn8rLS0d2CMvTF/w8rX4QFSivEFB65rA0dnOmUWeIPb5kpd1nCeVPpWlovvMgjjVaWmeahpF7AAwHHB2Pdhu8krsadvWSWZwEMeZRF42yZ9PwX2qGPKfi1g/vnKDACm94UZ5nqd7DvScSprLG9XCZskTI29P/OPzn8fcfDf1VtjQtKaVHyxZXkW4mK5z7TEfokDlfqdivU1A/.../4ho3WP Dkpa Sgv8&__rnd=820ebd6129e4be66ef6b7edcb03c8dfd

Remove teenage+mutant+ninja+turtles+.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.