home

the_last_remnant__[mediafire]_downloader_229.exe

Express Files Installer

Faglaro Enterprises Limited

The application the_last_remnant__[mediafire]_downloader_229.exe by Faglaro Enterprises Limited has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons. The file has been seen being downloaded from cntb.express-files.com and multiple other hosts.
Publisher:
http://www.express-files.com/  (signed by Faglaro Enterprises Limited)

Product:
Express Files Installer

Version:
2,0,0,0

MD5:
293972effdd51b156b9f9663c7dbc5be

SHA-1:
e2226ae9d274f02d7ed2bfaaf92f6716719db42a

SHA-256:
7d0d5075019cbcdb3baad7d386403d62ebdde15cba6a5211308b78fec6e8ccd0

Scanner detections:
8 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 7:37:30 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-140520

Baidu Antivirus
Trojan.Win32.ExpressFiles
4.0.3.14520

Comodo Security
TrojWare.Win32.UMal.~A
17963

ESET NOD32
Win32/ExpressFiles (variant)
8.9567

G Data
Win32.Application.ExpressFiles
14.5.24

McAfee
Artemis!293972EFFDD5
5600.7124

Reason Heuristics
PUP.Installer.FaglaroEnterprisesLimited.s
14.8.7.22

VIPRE Antivirus
ExpressFiles Installer
27576

File size:
4.7 MB (4,974,200 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.express-files.com/ (C) 2012

Original file name:
ExpressFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
Russian (Russia)

Common path:
C:\users\{user}\downloads\the_last_remnant__[mediafire]_downloader_229.exe

Digital Signature
Signed by:
Faglaro Enterprises Limited

Authority:
COMODO CA Limited

Valid from:
12/16/2011 3:00:00 AM

Valid to:
12/16/2012 2:59:59 AM

Subject:
CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET="Konstantinoupoleos, 22", L=Nicosia, S=Aglantzia/Cyprus, PostalCode=2107, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00DD2A4BBB66262A8FB4E084560573E908

File PE Metadata
Compilation timestamp:
3/29/2012 9:07:14 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:NQAxkbhEHxzE/h983qx5hVH6unQpPi3xAOWx7/zMCUtSJsrLMi:2bm+hSi53DnEHzxHWfMi

Entry address:
0x48200F

Entry point:
68, B4, DC, 47, 82, E8, 54, C8, FF, FF, 00, 00, 49, 6E, 74, 65, 72, 6C, 6F, 63, 6B, 65, 64, 45, 78, 63, 68, 61, 6E, 67, 65, 00, 00, 00, 49, 73, 56, 61, 6C, 69, 64, 43, 6F, 64, 65, 50, 61, 67, 65, 00, 00, 00, 43, 72, 65, 61, 74, 65, 44, 69, 72, 65, 63, 74, 6F, 72, 79, 57, 00, 00, 00, 54, 68, 72, 65, 61, 64, 33, 32, 46, 69, 72, 73, 74, 00, 57, 60, E8, 91, 0D, 00, 00, 00, 00, 54, 6C, 73, 46, 72, 65, 65, 00, 00, 00, 43, 6F, 6D, 70, 61, 72, 65, 46, 69, 6C, 65, 54, 69, 6D, 65, 00, 00, 00, 53, 65, 74, 4C, 61, 73...
 
[+]

Entropy:
7.8885  (probably packed)

Code size:
98 KB (100,352 bytes)

The file the_last_remnant__[mediafire]_downloader_229.exe has been seen being distributed by the following 4 URLs.

http://cntb.express-files.com/?q=bebuzz 5.0.29 license key.rar&wmid=000&subwmid=224&ca=f716950adaf09c83e8238f03238b3aed

http://cntb.express-files.com/?q=farming simulator activation key.rar&wmid=000&subwmid=224&ca=511aded8549475f146328233a05b8530

http://cntb.express-files.com/?q=budak cina sex&wmid=000&subwmid=352&ca=c41f1ee6bf46d1fab47d8a949c50e66e

http://cntb.express-files.com/?q=free webmail hacktool 2011.rar&wmid=000&subwmid=224&ca=ba089998a9c8ad01f51e931bd70c176c

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.