home

the.lord.of.the.rings.the.fellowship.of.the.ring.extended.2001.1080p.brrip.x264.yify.mp4.exe

Alexey Kurilenko

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application the.lord.of.the.rings.the.fellowship.of.the.ring.extended.2001.1080p.brrip.x264.yify.mp4.exe by Alexey Kurilenko has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from bestorms.info.
Publisher:
Alexey Kurilenko  (signed and verified)

MD5:
ce1fab3cdeb92558f525c299d9947747

SHA-1:
4b39450c07d13789bc6e34b17ccafb3d747b5ccd

SHA-256:
6dd71efa6a7a1740a164a9ea7db94bff67eccd1c8a1449c00e8bab43722c79b1

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/5/2024 9:27:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.AlexeyKu (M)
16.5.28.7

File size:
882.9 KB (904,056 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\the.lord.of.the.rings.the.fellowship.of.the.ring.extended.2001.1080p.brrip.x264.yify.mp4.exe

Digital Signature
Signed by:
Alexey Kurilenko

Authority:
Unizeto Technologies S.A.

Valid from:
6/17/2014 9:20:17 AM

Valid to:
6/17/2015 9:20:17 AM

Subject:
E=Alexey.kurilenko@hotmail.com, CN=Alexey Kurilenko, O=Alexey Kurilenko, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
15D51642691B3EE20985639A8FE865DD

File PE Metadata
Compilation timestamp:
6/7/2013 11:38:26 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:LLIrgWiY2Jf1t7rXe4LCe4AQfp1OTcsZp5xKC+qzSftCR:nIrgW8T7rXeGbdQR1McsTqqzgAR

Entry address:
0x3EFF6

Entry point:
E8, 78, 48, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, D5, 44, 00, E8, E4, 0F, 00, 00, E8, 45, 4A, 00, 00, 0F, B7, F0, 6A, 02, E8, 0B, 48, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D6, 08, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
284.5 KB (291,328 bytes)

The file the.lord.of.the.rings.the.fellowship.of.the.ring.extended.2001.1080p.brrip.x264.yify.mp4.exe has been seen being distributed by the following URL.

http://bestorms.info/1ea105c26e9dbbbb9d4043fc68ca8985/express/dl.php?id=1415297128308652499&r=http://bestorican.net/v1364/lp/?q= es1LifDP/9I789/XZIYw feLD3edzWAKq3HCC7FDxdJEtZATJvacJziv3YyX Xy Az6Rm34nn1wznDvXSCWRWvau5aQcGOrpaba M DSFg/BeoVYdGumheqvI/AFPCV H8J78peVasrwRPNyEBz3OoEQAYgOf0mJ86qbdhqEoQ/GmZ0CHN5DmF5gG0VJIy4GRAfbcwm9WwB Q75N1hJx/OUpZf oqCrj9HUWM8px2nP1sytOgROSEJmG5DSg2hj KgvULFUe7hTnK/BHS3v5e21u62ZBZuVaLxuwEAATAcmREwuh5CAP2nwEc/.../O91ImID8gzkn7mFO4v0M82zI08g3n4t2jM3VxqV6b9mRtWhLVqhfKDPw63AWR1p1DNLl0ZaUJ8UlrdaOCJvDFPwQFZVpX3rvuwSzmWBD120dwBMQLHZYZ4LIpFX98Dc0V7wrf9JW0Iwu2TF92H2oOqKQDFEapwUdnGi1QkrmaFztjOMDZPCOqejLbxU3Ob&__rnd=cf3c89f88e6551c85f2c9c5966b70823

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.