home

windows-7-professional-rus-torrent.exe

Firefox

APEP

The application windows-7-professional-rus-torrent.exe by APEP has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from win-torrent.net.
Publisher:
Mozilla Corporation  (signed by APEP)

Product:
Firefox

Version:
45.0.2

MD5:
7b8a1a605cba84fc5bd71715bff93d7b

SHA-1:
bde6ef7f0568fc34040faacfd82295c17103ad26

SHA-256:
145de69a6df59d0117cd6577153e2f1e2ccbc29285cd6ebd57745c24f47cd03f

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 4:47:55 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Adware.FileTour.DUY application
8.0.319.0

Reason Heuristics
PUP.FileTour.APEP (M)
16.7.26.7

File size:
2.3 MB (2,402,736 bytes)

Product version:
45.0.2

Copyright:
©Firefox and Mozilla Developers; available under the MPL 2 license.

Trademarks:
Firefox is a Trademark of The Mozilla Foundation.

Original file name:
firefox.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\windows-7-professional-rus-torrent.exe

Digital Signature
Signed by:
APEP

Authority:
COMODO CA Limited

Valid from:
6/10/2016 3:00:00 AM

Valid to:
6/11/2017 2:59:59 AM

Subject:
CN=APEP, O=APEP, STREET="Bajkalskaja, 216 A/5", L=Irkutsk, S=RU, PostalCode=664075, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
77C5C9138FCDB38AC8A8BF46C3C991C2

File PE Metadata
Compilation timestamp:
1/5/1990 8:18:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:DiODMvxulMlmyqnG8DS47yo3/QEV//W0c1o2PK8hmB8nXdZ30KjQkhoy:JD59G8m4+m/Q0Tc17PJYB8/30SQw

Entry address:
0x462001

Entry point:
4B, 33, C9, 33, D2, E9, 1F, 00, 20, 00, 00, DD, 43, 2F, BA, 0B, AB, 56, C0, AA, 6A, 28, 37, 97, 78, 2A, AB, C0, 75, 68, 75, 4D, BD, CF, AB, 0A, 56, 73, 76, 98, A7, 7A, 6D, EE, 70, 93, FA, A8, 4D, C4, 45, EB, 75, BB, 46, 60, 2B, 33, 71, 89, AC, 05, FD, EB, 5F, DE, 90, 13, D0, 1D, 35, 58, 17, 19, E3, 6C, B4, 16, D0, A9, CD, BF, DE, 71, 37, D7, 4F, 35, 20, FB, 31, 7D, 57, 08, 84, 1F, 7B, F3, 4A, 17, DD, 9D, CE, D4, AC, E6, 85, 26, 53, 3E, 9E, 03, F4, 51, C1, AD, A1, 48, E1, 2F, 63, B7, 00, 5B, D0, F3, 4B, E2...
 
[+]

Code size:
2 MB (2,075,648 bytes)

The file windows-7-professional-rus-torrent.exe has been seen being distributed by the following URL.

http://win-torrent.net/.../classes/dlemic/dlemic.php?sid=NDI=&url=aHR0cDovL3dpbi10b3JyZW50Lm5ldC9lbmdpbmUvZG93bmxvYWQucGhwP2lkPTI4NTg=&name=V2luZG93cy03LVBST0ZFU1NJT05BTC1SdXMudG9ycmVudA==&type=Ng==&href=http://win-torrent.net/.../download.php?id=2858

Remove windows-7-professional-rus-torrent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.