home

terraria.exe

Cilap

Morava Group

The application terraria.exe, “Cilap Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.appsfilessafe.com and multiple other hosts.
Publisher:
Morava Group  (signed and verified)

Product:
Cilap

Description:
Cilap Setup

MD5:
05b18837e0571a5094ae618fed74e85e

SHA-1:
c45193aca7fc4d57bf8f16ff75e4cd807e549511

SHA-256:
443794e39448029c21fea13ef3c3c8480ef8425ab3cc9ac858c30af929cca670

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 1:54:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.5.14.8

File size:
925.9 KB (948,152 bytes)

Product version:
3.7.3

Copyright:
Fast Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\terraria.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 3:28:01 AM

Valid to:
3/8/2017 3:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OH9a0YfN12k11Me/htysP9NLE/MJmPh6L:CRYfN124yghtJDLyMJmh6L

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9339

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file terraria.exe has been seen being distributed by the following 7 URLs.

http://www.appsfilessafe.com/c?x=3iRZdNdGgGH1 tg3KFoflIRiue/VJKd FasN4QLwmps=&c=XxGmJgEDHP6 Gc/5uaqiZcL7waJTiQSzr3PHoPEKHcfdqcuV92v7gb15HfFUW9AOMD/.../okRRxg9KmE164b6ZzSkkZZjEcDIDuP50inbQDDyQBY80Ese 7QVZFkgTF1U6Xnc6VRhyTz6ijo82mrlVv70=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=20cCGb8OZG5PDYrsuzUN6bALMaRisPPibTxT3 C6CSs=&c=oWsB1Rg5NdcK6Ks648 9xlO9vQhtn5lr5Ue935GFKkHXBJX6yLiCiNAgOD1GKYITBO05lCbEXfTl4rIhwaKvurDTvW8GRyKJC60lFv8m7o2o4 IP86QtV9BiAZ v6tTx&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=QqAhZcDQ9FIQDHbZy4wCFfXPjudgZ2RyFbAIZIf3Yd8=&c=QCCOebEPnGBi9RVM5FtluG55dZmMi nLUxgrKveDubzCRej/SUwV/ZGOv2tWDxIThxswkTImOQ3ozoiY5tmscu4RbKwCxIEnvHktJZo2tc7P5b7f/Uk3iwAyumGI7LkyocypxzDif6Axoa/F/.../8=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=fkCjug8GPqviS4fADXbmcWSZndocdy1G/j3om8bbul4=&c=JaKMnkinEErqKqKlIJ/yuEi5HczkXLa7uM2Xd/YTm7nnknWVJ3/6mH5B0ZDV46/.../K5G0M6 x99UXn bTSv5Hqk3s8zxVxFDrCTpE7lALA5i35pkLOP7XF4zXvcXUaWGLecmU7bomm0KSUZMmC 3HgiGsELOdul4mZBvSf&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=o1iOdL/.../nFBVTAJwVY5NaQ5NrEFdPqOQd3k0wlI5 jA ux3C03vob4mzLcPILooDOoqfj2sbdIejwImv5Up3bJr4Pswsr0qtb2SriZzhc3ejW8PUjE=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/.../Bz4BR2CDoz1WcVqQXME7yEiEngb0eCdccndJu54K1AHjvV2GpjM9Iuezn2WiqRUO8aFYJyiXEV4QY=&e=0&downloadAs=terraria.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=0AivwHmCL7ftAtz8SsxS9m/ey3d81uBgAkR9HzbcclE=&c=2msXRsjPkXnkXCugy4BDDUUojkX DGae3ZDN0xWq2Ba/Z40/.../8K6ipcJfPTGOUwkgVUi goTjuLvg4 04fCUHeMvIF78T6 GDkpSmwkvT wVVW9ajRhTfJB&downloadAs=terraria.exe&fallback_url=Fallback URL

Remove terraria.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.