home

tranz_smd_tom_2__2007.exe

MAXTEK LLC

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application tranz_smd_tom_2__2007.exe by MAXTEK has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. The file has been seen being downloaded from hnb5b7vedwug67b.cuhoivno.ru.
Publisher:
MAXTEK LLC  (signed and verified)

Version:
1.0.0.0

MD5:
34a875e768b5f48511f67d3f02910718

SHA-1:
d249597904d92f573ec222780c32d448aec2b337

SHA-256:
40371b1b17f51dcfa2eb970b3f1c91daae8953e3ab939150272ba0d26a4537e8

Scanner detections:
13 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 12:35:32 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Graftor.171471
682

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
TR/Fraud.Gen7
7.11.202.28

avast!
Dropper-gen [Drp]
2014.9-150324

Bitdefender
Gen:Variant.Graftor.171471
1.0.20.415

Emsisoft Anti-Malware
Gen:Variant.Graftor.171471
8.15.03.24.02

ESET NOD32
Win32/InstallMonstr.HI potentially unwanted application
7.0.302.0

F-Secure
Gen:Variant.Graftor.171471
11.2015-24-03_3

G Data
Gen:Variant.Graftor.171471
15.3.25

K7 AntiVirus
Unwanted-Program
13.193.14900

MicroWorld eScan
Gen:Variant.Graftor.171471
16.0.0.249

Reason Heuristics
PUP.Bundler.Outbrowse
15.3.18.1

VIPRE Antivirus
Threat.4150696
37240

File size:
6.9 MB (7,197,496 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
English (United States)

Common path:
C:\users\{user}\downloads\tranz_smd_tom_2__2007.exe

Digital Signature
Signed by:
MAXTEK LLC

Authority:
thawte, Inc.

Valid from:
12/29/2014 2:00:00 AM

Valid to:
12/30/2015 1:59:59 AM

Subject:
CN=MAXTEK LLC, O=MAXTEK LLC, L=Kharkiv, S=New Brunswick, C=UA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
5E330605B7CB3B14509516AEA2289E49

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:ejfa3aLmYVsLHFLKTPUrw0UuXC6h+GimfRybXVwvrrGa04nyscToz4YYKUu/VKuB:ejEyfuRRgVwnGN4nBLn/VKuzxSQ1JlAA

Entry address:
0x349DE8

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, 60, 93, 74, 00, E8, 57, DB, CB, FF, 33, C0, 55, 68, B3, CF, 74, 00, 64, FF, 30, 64, 89, 20, E8, 54, 62, D2, FF, 85, C0, 74, 07, 33, C0, E8, 61, B0, CB, FF, B8, D0, 61, 83, 00, E8, 13, B1, CB, FF, A1, D0, 61, 83, 00, E8, D9, B3, CB, FF, 8B, D8, E8, 2E, 62, D2, FF, 3B, D8, 0F, 85, A8, 00, 00, 00, C7, 05, CC, 61, 83, 00, 20, 00, 00, 00, 68, D4, 61, 83, 00, E8, 7A, 1E, CC, FF, 68, D4, 61, 83, 00, E8, 70, 1E, CC, FF, 68, D4, 61, 83, 00, E8, 66, 1E, CC, FF, A1, CC, 61, 83, 00, F7...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
3.3 MB (3,457,024 bytes)

The file tranz_smd_tom_2__2007.exe has been seen being distributed by the following URL.

http://hnb5b7vedwug67b.cuhoivno.ru/eyJ2ZXIiOiIxIiwic2lkIjoiMzAxMCIsInVybCI6Imh0dHA6Ly85LmJlenNtcy5vcmcvZmlsZXMvOC83aDBzeTJoZDB3ZnUwMy9UcmFuel9TTURfVG9tXzJfXzIwMDcucmFyIiwibmFtZSI6IlRyYW56X1NNRF9Ub21fMl9fMjAwNy5yYXIiLCJ0eXBlIjoiYXJjaGl2ZSIsInNpemUiOiI5MzMyNzM4MiIsInJuZDAiOjYwMDY3OTY4NzQ1NzE1fQ

Remove tranz_smd_tom_2__2007.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.