home

terraria.exe

Befibir

Morava Group

The application terraria.exe, “Befibir Setup ” by Morava Group has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appscleanflash.com and multiple other hosts.
Publisher:
Kulat   (signed by Morava Group)

Product:
Befibir

Description:
Befibir Setup

MD5:
ab2eaf18475de44a5b3563a5638694d6

SHA-1:
14e41a0814f3b9f4743dec3456a8f403b487e4da

SHA-256:
4149b63e3bbd320ce6cb14bd42a5560f8bf2f78c66c17dff6cfdd63961a6ed0a

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:32:49 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AFW potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.4.12.22

File size:
971 KB (994,352 bytes)

Product version:
2.3

Copyright:
Software Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\terraria.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 3:28:01 AM

Valid to:
3/8/2017 3:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QmdmwFjzyzV8q8viESE6v3auceqLPmaNtz5DyP2jGnyO9:QgPBeRcviE503auceqLug8CGnyS

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9055

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file terraria.exe has been seen being distributed by the following 12 URLs.

http://www.appscleanflash.com/c?x=B28JWC q6jeosYFjkUYjw5dfFb7yaeqdgK/mRMTlRh8=&c=3dSAnGCILfklyp1hpaatj6IbtyvkRHsvwSVCzIo0SI48Vy/.../qZTh&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=mdlUbpVae n8DzfwBYrVhWSRKymGNl/SnqQ1k/.../6tslDIKjBGQ7NIqHHn&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=oMPpSJkIRBUnWK99A dFczemLD5nCcH34xaXEQQ0Or8=&c=dGbc5XngSBo4h8ph04rzv0ADZ2rfp7gF75QHbDFIkuVsAxUOEO06ZZWqFn sC1IxgaBBNPuf/GavNC 4hMkV2jZRHp5gfrpKCWMKG7p0d11pDbGvUiCQyiZ/sa3WsZ tshemva7BFLy0hsoqRKBk9srNMQytl/.../bsJsQM2y0=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=VoiRN2xfNO4nu4s8JR2sIuK06G5aI4H0FmrHP663lj0=&c=yIq5cycgz7YuVa0PV4pvHIIYuXL63AwRAhALx6NPdu1h4tMZf/ lolEwFugo3ejRmyDqGVhA/625ffZlJg3S SP4kJ0bO uYnYo 3t9UDND5WHvwyal/.../zWCU2s4Y=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=wQawuChicLAEpA03eaXGaDdjXoMy1zvFV0Ley4ZXo4s=&c=p0pyG8Anb4euCggS8Jxwh0PGzV1AldDJ9uk57cUXZgjIlz4cgF6nErMN/.../qv 4tyo&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=QOXfDI3z/0Iefj2ys2cn8n13lTNvsjiJqGQdCeOA7zE=&c=BUJm yqEZctWbAjWbnxUBaFgS8HJUFz5kEqXHbxBv AB3lgfVPdSzrY4hzDBJTx2yH12aPsPYpBOrcBUTNaARWlGvDBppSnRvuR7PkRczxz7//71qlJoMDHKzKGSo6BO&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.currentapplicationsvault.com/c?x=qyOkUxM0Wjes2R76sVp7n5YBxmkF3 8FoWHb/5ud fc=&c=fm/Fg994QPxa4Cvcvsv7UAFKfNte5R/.../etQ7VdK6Jg4Wdvk FjO48Pg 77NPeul1&e=0&downloadAs=Terraria&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=9AsjnNEDt95r4QD7G8KbL8aXfNeucSj94ACYlSiFV88=&c=rcAZ3vGjf3GdYxMsR/.../Zu8Q368smaXYn6QZZEcTFAUkAZwcH4ma83SFXC1CP2OUomsD6gKeKCwOfJKlrgs4BW3caHEOBKmfsFVRBMY2DmHQmzLxD2uri6H2ubvciDP8ep4WIz0QUGl7bgsbTF72ib4ciu4ndZvK2KsHAc=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=9gSEDCy5XJ5b4zvGh1kLdTppSIviSIu1xI A8Ka6erU=&c=lSdQvZCLfzOvOwv/OSbEv8cQBBMYZeDqN05VHnDjDduYIFsfGu dlaOEfQwfsrrzilRVplyX5gx LH7gdGtDSWN1/MZ8QL RkHDHvudNvzHORTbhzKPtJm0En1f2Nh3Db4U433r6NhK3h2/.../rc=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=uvFlAFkY7uuKap2Ku0ONijv19NiGGiOkflWucyLaoVY=&c=dfByndhYlvs6pwlT2L5djnGpyY6QOJThhYcjHmDE1gEDkCoqzgIohmOS4pzAlkTs27IfMQxeFXBxvo2RLNIWVOAMzf/JTiYZFYvRdq/.../6krq5u0DY0iDcIsFL8oC5Y8rovv9PRdpIoM8F2&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=C u/IfQ /8uZBC1nkn74ohzW1BUlrgXnnfXJXjGt D4=&c=hW9lWKj0kelC/1e 8kgH10EiHOsLXAvdtEYvgVbeVBSxYbTMAlR94IpWgPMLHycp58hsmhdCbsqzFIUlBTBRxt8/QV/05mvT98iSno94i8DMWomXbGOt17qSq5ETm8ixAiqbC3p7axtSTiC K 4l 3/.../vktwA=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appscleanflash.com/c?x=fWNs3wymjV1r7o2SyTzDY0Z6CC UyAq4IQa8ainm2 s=&c=JqbM7C5xnJ3N/K1a3ff1QQS x A1tU3iKbbgj/AWP0ptBTPo2H1v6VJWjLxkep6NpLNq1c9h5 NkNP7hE/.../KQGRrRUJLXb8G&downloadAs=terraria.exe&fallback_url=Fallback URL

Remove terraria.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.