home

the.laurentine.spy.pdf.rar_downloader.exe

GoForFiles Installer

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application the.laurentine.spy.pdf.rar_downloader.exe by Righway Technologies, Inc has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dw901.go-for-files.biz.
Publisher:
http://goforfiles.com  (signed by Righway Technologies, Inc)

Product:
GoForFiles Installer

Version:
1, 0, 386, 1

MD5:
08a3d86ce96dd77e82ba6566218481e6

SHA-1:
35cc2fb34a2cd191ea8e325b2d3aff4ca4dfbfbf

SHA-256:
79bc827e8c3315dca2b8e1c9db7c77c583c29587d76e1cfbff7e76885d633084

Scanner detections:
12 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/14/2024 9:12:53 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Downloader.Gen4
7.11.204.154

avast!
Win32:Adware-gen [Adw]
150102-1

AVG
Righway Technologies
2016.0.3221

Comodo Security
Application.Win32.EDown.FTVP
20811

Dr.Web
Adware.Downware.4798
9.0.1.05190

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application
7.0.302.0

F-Prot
W32/A-a2175f9d
v6.4.7.1.166

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.191.14726

Reason Heuristics
PUP.Installer.RighwayTechnologies
15.1.22.23

Sophos
PUA 'Go For Files'
5.09

VIPRE Antivirus
Threat.4925438
36694

File size:
3.7 MB (3,905,864 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://goforfiles.com (C) 2014

Original file name:
GoForFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/21/2012 6:00:00 PM

Valid to:
8/22/2015 5:59:59 PM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
11/20/2014 7:29:03 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:Wjnss4yYiTB1TzKwRUn0iy4mPljnDDUBm0CMhp:os9iTB1TzXO0YClj6Rp

Entry address:
0x6BB95A

Entry point:
E9, C0, 08, 00, 00, C6, 04, 24, 83, 66, 0F, BA, E0, 0F, E9, C3, 52, 01, 00, C6, C6, 00, FF, 74, 24, 04, 8D, 64, 24, 2C, 0F, 84, 21, 82, 01, 00, B0, 8C, 8D, 04, 93, 55, E8, 02, 1F, 00, 00, 66, 0F, B3, D8, 27, 89, D0, 00, C0, F6, D0, 83, C7, 01, F6, D0, C6, 44, 24, 04, 93, 1C, 4E, 8A, 07, 66, F7, C6, 83, 6B, 66, 0F, BA, E3, 0B, 84, C0, 60, 8D, 64, 24, 28, 0F, 84, BD, 86, 01, 00, 68, 63, 65, B4, D7, 60, 2C, 30, E9, 76, DF, 07, 00, 7B, D3, 5B, EA, D7, F7, CF, 0D, 48, E0, 49, A6, 0B, D3, 7E, 65, E5, 74, C9, 66...
 
[+]

Entropy:
7.8075

Packer / compiler:
Xtreme-Protector v1.05

Code size:
782.5 KB (801,280 bytes)

The file the.laurentine.spy.pdf.rar_downloader.exe has been seen being distributed by the following URL.

http://dw901.go-for-files.biz/j5GRX2eehVpzxqhRftG/JiDvpT48sL0tOLa8PTy8km4v NRhFOnbahbnyyxfupgHE XMUwTS3xtXlokBX5peGlrRNlE2gmgdIJ1uID6BYeZzzTPkPml64GswO/s e377MX9RqhZ4TPoCZ0P6HjZSzAM6QcMBf1rEA0pJ3QMVFOBYXiDW7m8q1 9XJuDkV2z2qEgxtM0pKfancWjho3FP67B9VeOEJQiEzjUet5dqENabOUyDhFIaiYRQSI6CWOXDiQiwlfoWuc2lEbTL817kYvM/3SG 56RuuKL bq61lDWu/spzl/.../wkCzM7IxC

Remove the.laurentine.spy.pdf.rar_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.