home

Toparcadehits.exe

Top

The application Toparcadehits.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from 127.0.0.1 and multiple other hosts.
Publisher:
Top

Product:
Top

Version:
4.0

MD5:
cb757d97f37a7c9d23d96d6fee514c9e

SHA-1:
00aa26c41aad212d8fe677eb701f784bcbff58b6

SHA-256:
18e975c0ab264f73b1211ab9185a6e8962f73d2c94fd093da0266d936086ebbd

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
11/23/2024 11:25:59 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
NSIS:Adware-KE [PUP]
2014.9-130827

Baidu Antivirus
WebToolbar.Win32.Toolbar
4.0.3.131126

Dr.Web
Adware.Downware.1445
9.0.1.0330

ESET NOD32
Win32/OutBrowse
7.8901

herdProtect (fuzzy)
variant of greatarcadehits.exe (Adware)
2013.12.20.16

Kaspersky
not-a-virus:WebToolbar.Win32.Toolbar
14.0.0.3799

Sophos
Generic PUA AA
4.93

Trend Micro House Call
TROJ_GEN.R047H07HJ13
7.2.239

File size:
104.1 KB (106,577 bytes)

Copyright:
© Top

Trademarks:
Top

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\toparcadehits.exe

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:AgXdZt9P6D3XJS45NsCpO5K8Unhddi2ecAQETZ:Ae34QGnpOU8UnhDif

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.4823

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file Toparcadehits.exe has been seen being distributed by the following 2 URLs.

http://127.0.0.1:37848/continue?TiCredToken=25187&Source=WTP&URL=http://cdn.file2desktop.com/.../Toparcadehits.exe&Permanent=1

http://cdn.outbrowse.com/.../Toparcadehits.exe

Remove Toparcadehits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.