home

torntv4pack.exe

Rungnapa Fongkerd

The application torntv4pack.exe by Rungnapa Fongkerd has been detected as adware by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com.
Publisher:
Rungnapa Fongkerd  (signed and verified)

MD5:
b3a26df9b0e37a31045f050c3ecf75ee

SHA-1:
89d105e584f2d653d1afa2aadc53480879c61832

SHA-256:
0e1c6af0642f6017c1a7a28241e2f38b934c0f40c0925c85d542d4db6dfde45f

Scanner detections:
4 / 68

Status:
Adware

Explanation:
The installer bundles additional adware-type offers (ad-supported) that are displayed to the user during setup and typically installed by default. These include web browser ad-injectors.

Analysis date:
11/27/2024 1:29:45 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Rungnapa
2015.0.3384

Dr.Web
Threat.Undefined
9.0.1.0295

IKARUS anti.virus
AdWare.OneClickDownloader
t3scan.1.6.1.0

Reason Heuristics
PUP.RungnapaFongkerd.L
14.8.12.15

File size:
275.7 KB (282,304 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\torntv4pack.exe

Digital Signature
Signed by:
Rungnapa Fongkerd

Authority:
Thawte, Inc.

Valid from:
7/27/2014 9:00:00 PM

Valid to:
7/28/2015 8:59:59 PM

Subject:
CN=Rungnapa Fongkerd, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Thailand, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
5EC13B211C7584BB92BAC58CF7ED1F63

File PE Metadata
Compilation timestamp:
12/5/2009 7:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:nQqJSK6b0eEpRODYOv7yg1hUg23rogiINLyWjd1QevGGb9R+:N6tEjkygDUg2DiI/1QevL9R+

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file torntv4pack.exe has been seen being distributed by the following URL.

http://cmpsmarter-downloader.maynemyltf.netdna-cdn.com/TornTV4Pack.exe

Remove torntv4pack.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.