TornTVApp.exe

TornTVApp

CoolMirage Ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application TornTVApp.exe, “TornTV Application” by CoolMirage has been detected as adware by 16 anti-malware scanners. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www1.installstarter.com and multiple other hosts. While running, it connects to the Internet address sage.parklogic.com on port 80 using the HTTP protocol.
Publisher:
TornTV.com  (signed by CoolMirage Ltd.)

Product:
TornTVApp

Description:
TornTV Application

Version:
2.0.0.1

MD5:
c6cc74b46e94f23866439c8e39ce0279

SHA-1:
6acf8f00918e6e87ea986274d6fd5d364222df5b

SHA-256:
7389a0e391974ad5fa52e4150344b2d09b8c6faa5c49775a842fb79f120aa738

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/5/2024 8:08:50 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Yontoo
7.1.1

AVG
Generic
2015.0.3256

Bkav FE
W32.Clod40d.Trojan
1.3.0.4613

Dr.Web
Adware.Yontoo.25
9.0.1.0353

IKARUS anti.virus
not-a-virus:AdWare.Yontoo
t3scan.1.8.5.0

Kaspersky
not-a-virus:AdWare.NSIS.Yontoo
14.0.0.2775

McAfee
Artemis!C6CC74B46E94
5600.7277

nProtect
Trojan-Clicker/W32.Agent.827648
14.12.11.01

Panda Antivirus
Generic Suspicious
14.12.19.01

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.CoolMirage.J
14.8.7.17

Trend Micro House Call
Suspicious_GEN.F47V1210
7.2.353

Vba32 AntiVirus
AdWare.Yontoo
3.12.26.3

VIPRE Antivirus
CoolMirage Ltd
25064

XVirus List
Win32.Detected
2.8.7

Zillya! Antivirus
Adware.Yontoo.Win32.51
2.0.0.2003

File size:
808 KB (827,384 bytes)

Product version:
2.0.0.1

Copyright:
(c) TornTV.com All rights reserved.

Original file name:
TornTVApp.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\torntvapp.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/5/2013 5:00:00 PM

Valid to:
6/6/2014 4:59:59 PM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
4/7/2013 3:55:55 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:x10Q37SEEY8i3J7iFf6cH5B+5fbK3qvSmE+mPP7j8Iru9XL/by3CS:xyYef66DaTK3q68aP74IrulA

Entry address:
0x20D21

Entry point:
E8, 63, 74, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63, FC, FF, E0, 5B, C9, C2, 08, 00, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 8B, FF, 55, 8B, EC, 51, 51, 53, 56, 57, 64, 8B, 35, 00, 00, 00, 00, 89, 75, FC, C7, 45, F8, 9D, 0D, 42, 00, 6A, 00, FF, 75, 0C, FF, 75, F8, FF, 75, 08, E8, 53, 05, 01, 00, 8B, 45, 0C, 8B...
 
[+]

Entropy:
6.2462

Code size:
201.5 KB (206,336 bytes)

The file TornTVApp.exe has been seen being distributed by the following 4 URLs.

http://www1.installstarter.com/TornTVApp.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to sage.parklogic.com  (69.39.236.56:80)

Remove TornTVApp.exe - Powered by Reason Core Security