home

the-sims-3-patch-1.67.2.exe

The Sims

Sevas-S LLC

The application the-sims-3-patch-1.67.2.exe by Sevas-S has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from www.joydownload.com and multiple other hosts.
Publisher:
Sevas-S LLC  (signed and verified)

Product:
The Sims

Version:
1.0.0.0

MD5:
e1679008c5f540d7a9ee3307babade81

SHA-1:
62847e99b735ef270eabd10ab7de158c03a5ba18

SHA-256:
8b9054fa62e78f3b37149491908574f0e9d4860d70f6fe48906b66eeccf088ef

Scanner detections:
8 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/25/2024 8:28:42 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Downloader
2015.0.3458

Dr.Web
Adware.Downware.1446
9.0.1.0151

ESET NOD32
Win32/JoyDownloader
8.9614

Malwarebytes
PUP.Optional.OpenCandy
v2014.05.31.08

McAfee
Artemis!E1679008C5F5
5600.7114

Reason Heuristics
Unnamed.Threat.14
14.5.31.8

Rising Antivirus
PE:PUF.OpenCandy!1.9DE5
23.00.65.14529

VIPRE Antivirus
Sevas-S Installer
27868

File size:
475.4 KB (486,816 bytes)

File type:
Executable application (Win64 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Digital Signature
Signed by:
Sevas-S LLC

Subject:
CN=Sevas-S LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sevas-S LLC, L=Kyiv, S=Kyivska oblast, C=UA

Serial number:
4B35AC223F4DB03D3B4C5368983A4B53

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
12288:GaCytD78b+UgY/vFhjs17FEUDTTup+Ts9PJYz5jtNcB+/TRfYI:4kD7WdDFhm7FjDHuzJYz5jtXTBYI

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 34, 71, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 58, 92, 42, 00, E8, 90, 2E, 00, 00, A3, A4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 58, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, C0, 92, 40, 00, 68, A0, 81, 42, 00, E8, FB, 2A, 00, 00, FF, 15, 38, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, E9, 2A, 00, 00...
 
[+]

Entropy:
7.8835

Packer / compiler:
Nullsoft install system v2.x

The file the-sims-3-patch-1.67.2.exe has been seen being distributed by the following 5 URLs.

http://www.joydownload.com/wi/z6SlWY0TRV7XnXMmr95OBA/1396193473/1/3/1/.../the-sims-3-patch-1.67.2.exe

http://www.joydownload.com/wi/4ef47921ef1128bb70ffac0df9ed0775/1/3/1/.../the-sims-3-patch-1.67.2.exe

http://www.joydownload.com/wi/3b_5jPmwdt969TdBeC5n8Q/1397527180/1/3/1/.../the-sims-3-patch-1.67.2.exe

http://www.joydownload.com/wi/64495d063ffcf893ce3fcfddd98b522b/1/3/1/.../the-sims-3-patch-1.67.2.exe

http://pl.joydownload.com/wi/f97kuo23Jk82kh_Dr3oOKw/1395803369/1/3/1/.../the-sims-3-patch-1.67.2.exe

Remove the-sims-3-patch-1.67.2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.