» windows 7 loader 2.0.7.exe
Overview
Analysis
File Details
Downloads (9)

windows 7 loader 2.0.7.exe

The application windows 7 loader 2.0.7.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. This is a setup program which is used to install the application. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from doc-08-7o-docs.googleusercontent.com and multiple other hosts.

File name:

MD5:

6dea037252f3f30767e78945296c6c9f

SHA-1:

3d797bbe824b5934575492318ba47279f72a6815

SHA-256:

bbaaa58db388d5f6d4d8476661f89a0f6593c9b5767b7bae9660b64c31e751cc

Scanner detections:

6 / 68

Status:

Potentially unwanted

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:

11/27/2024 2:35:02 PM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Adware.MSIL.OutBrowse

4.0.3.1549

Bkav FE

HW32.Packed

1.3.0.6379

Kaspersky

not-a-virus:AdWare.MSIL.OutBrowse

14.0.0.2216

McAfee

Artemis!6DEA037252F3

5600.6800

Panda Antivirus

Generic Suspicious

15.04.09.05

Trend Micro House Call

TROJ_GEN.R021H05D715

7.2.99

File size:

1.3 MB (1,395,870 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\windows 7 loader 2.0.7.exe

File PE Metadata

Compilation timestamp:

1/31/2011 12:44:13 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

24576:4Q9oGoqhFcNl6uFLdpPA1lrvbytJKcfnEIH26boDS58ISqvvAUDJQo8I9Nkd:4QDsNHLbuljGtJKMnVW6bomy0v7DJQtT

Entry address:

0x1D20

Entry point:

55, 8B, EC, 6A, FF, 68, 28, 21, 40, 00, 68, A0, 1E, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 88, 20, 40, 00, 59, 83, 0D, 54, 35, 40, 00, FF, 83, 0D, 58, 35, 40, 00, FF, FF, 15, 84, 20, 40, 00, 8B, 0D, CC, 32, 40, 00, 89, 08, FF, 15, 80, 20, 40, 00, 8B, 0D, C8, 32, 40, 00, 89, 08, A1, 7C, 20, 40, 00, 8B, 00, A3, 5C, 35, 40, 00, E8, 10, 01, 00, 00, 39, 1D, BC, 32, 40, 00, 75, 0C, 68, 9C, 1E, 40, 00, FF, 15, 78, 20... 
[+]

Entropy:

7.9804

Developed / compiled with:

Microsoft Visual C++ v6.0

Code size:

4 KB (4,096 bytes)

The file windows 7 loader 2.0.7.exe has been seen being distributed by the following 9 URLs.

https://doc-08-7o-docs.googleusercontent.com/docs/securesc/ih874qlep338c95vvbhj15nd39llb55m/e5h6l0akdn3ulhmcfm35plnkl8rbqs80/1428667200000/10818865060830530735/.../0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download

https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/.../0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&nonce=utg5dtdnou804&user=00021233292836426411&hash=sre7lo0eq48d61fa506c0e380u3ect36

https://docs.google.com/nonceSigner?nonce=utg5dtdnou804&continue=https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/00021233292836426411/0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&hash=epb1c6eu579dqg86uvqbi7s27c1gocqk&urp=https://href.li/?https://.../uc?expor&pli=1&auth=DQAAAOYAAABO6BmiusGXOOPTMVx_iCGcAUBDQyTdqK8zH0HGCcBEccBm-BW6xOiGpHSqkV8cTdTFurJZKF7ERIXVbl4KzvMCOdcAZp-WHPWtyw-fb_U4ymViPhVwr8_WrfptVyOnswUdg4FSy0AttHQjyFg0fnueExYpwRiFmkj-hMljewDEjKsOB4tQ2VZqU01l-qKUX-DAOITTaKahvD9w1-BoEDnj5_bqbOCiVrKUl39H84C9o299Ju8oE4BEa3Z29C2eX8MIutt8i-YsiEN1-TD6MZ-PQVxTT5PkgqGA5SRJVTu8BuGhL990lD6HdxdA8u98Lxo&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=utg5dtdnou804&continue=https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/00021233292836426411/0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&hash=epb1c6eu579dqg86uvqbi7s27c1gocqk&urp=https://href.li/?https://.../uc?expor&followup=https://docs.google.com/nonceSigner?nonce=utg5dtdnou804&continue=https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/00021233292836426411/0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&hash=epb1c6eu579dqg86uvqbi7s27c1gocqk&urp=https://href.li/?https://.../uc?expor&ltmpl=h

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/nonceSigner?nonce=utg5dtdnou804&continue=https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/00021233292836426411/0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&hash=epb1c6eu579dqg86uvqbi7s27c1gocqk&urp=https://href.li/?https://.../uc?expor&followup=https://docs.google.com/nonceSigner?nonce=utg5dtdnou804&continue=https://doc-10-58-docs.googleusercontent.com/docs/securesc/1s0v7fr37sl6bmjkpirqnhvtkjvhf08v/b6iscfnhejdbgh800evf0ar8pfs4h38q/1428703200000/10818865060830530735/00021233292836426411/0B3m0RXoGTIzxbDRia1NlaFdnV0k?e=download&hash=epb1c6eu579dqg86uvqbi7s27c1gocqk&urp=https://href.li/?https://.../uc?expor&ltmpl=homepage&authuser=0

https://drive.google.com/uc?export=download&id=0B3m0RXoGTIzxbDRia1NlaFdnV0k

Remove windows 7 loader 2.0.7.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.