» windows-7-sp1-aio-32_id760070ids2s.exe
Overview
Analysis
File Details
Downloads (11)

windows-7-sp1-aio-32_id760070ids2s.exe

mediaget-installer Module

Banner LLC

The application windows-7-sp1-aio-32_id760070ids2s.exe, “MediaGet installer” by Banner has been detected as a potentially unwanted program by 10 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from sub2.bubblesmedia.ru and multiple other hosts.

File name:

Publisher:

MediaGet LLC (signed by Banner LLC)

Product:

mediaget-installer Module

Description:

MediaGet installer

Version:

1.0

MD5:

1a63d23457b632fed93c4bda39071843

SHA-1:

fb5afcb8e77e8feae7ea594033485802972e2699

SHA-256:

8c152003ebf32f1c4a3c71b4db4e5ea5c53aca1ff76ef29f4cf3111cffea9520

Scanner detections:

10 / 68

Status:

Potentially unwanted

Analysis date:

11/27/2024 6:29:31 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/Mediaget.AD.1

7.11.145.12

AVG

MalSign.Banne

2015.0.3495

ESET NOD32

Win32/MediaGet (variant)

8.9714

G Data

Win32.Adware.MediaGet

14.4.24

Kaspersky

not-a-virus:Downloader.Win32.MediaGet

14.0.0.3970

Malwarebytes

PUP.Adware.MediaGet

v2014.04.24.01

McAfee

Artemis!1A63D23457B6

5600.7151

Reason Heuristics

PUP.Installer.Banner.c

14.5.10.12

Sophos

MediaGet

4.98

Trend Micro House Call

TROJ_GEN.F47V0418

7.2.114

File size:

654.5 KB (670,240 bytes)

Product version:

1.0

Original file name:

mediaget-installer.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\windows-7-sp1-aio-32_id760070ids2s.exe

Digital Signature

Signed by:

Banner LLC

Authority:

COMODO CA Limited

Valid from:

3/26/2014 2:00:00 AM

Valid to:

3/26/2017 1:59:59 AM

Subject:

CN=Banner LLC, O=Banner LLC, STREET="lit.A, pom. 7N, 21 Serebristy bul.", L=St.Petersburg, S=Russia, PostalCode=197341, C=RU

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

75D61BEBB47652BF2C5DF2DDF44F0E3A

File PE Metadata

Compilation timestamp:

4/18/2014 4:23:15 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:DlTdnklRlX7vwqvdI/Db+EqtvtRSKxwjeO/xOJOsg6NSTEPVU:fnklRlrIqi/DyNtRSKxw8McSeU

Entry address:

0x15ED80

Entry point:

60, BE, 00, 90, 50, 00, 8D, BE, 00, 80, EF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

344 KB (352,256 bytes)

The file windows-7-sp1-aio-32_id760070ids2s.exe has been seen being distributed by the following 11 URLs.

http://sub2.bubblesmedia.ru/go/?link=O1vt74VzmklQJcp1IHTyeOlyGtOF9s7wDpKdiZQg7jQoKkWXDdt03wpjuMzdZ VxcyDGVZJS07pndQo9H2OHyGKV0d3QCHDscxbCjIrpL6xL Ynp3nlCp78dvliWbNDaT9VKjxBJVw6TXnYOle70aXsOld8MeNhulE5DYi9c9iVi6F2ziydmbhIfRzo=&param=4EEypCZtcio=&rid=995&s=???????? ??????? (5 ?????: 1-19 ????? ?? 22) /.../ The Vampire Diaries [2013, ?????, ?????????, ?????, WEB-DLRip, ???????????????? ??????????? [????? ? ????]] • , , , , , &cs=UTF-8&u=

http://www.mmohelper.ru/go.php?http://sub2.bubblesmedia.ru/sb/clk/s/1665/o/145/p/1266/.../0?a=1

http://sub2.bubblesmedia.ru/sb/clk/s/1738/o/145/p/961/.../0?a=1

http://www.softportal.com/getsoft-15445-mediaget-1.html

http://sub2.bubblesmedia.ru/go/?link=8tpgYctyZity9cSc/oz7odv8agS8mlOP/.../OcN7Ss=&rid=909&s=??? ??????? ??????? ?????? ???????????? ????? ? ????? ? ? ????? ????????&r=free-tracker.net&f=??? ??????? ??????? ?????? ???????????? ????? ? ????? ? ? ????? ????????&cs=windows-1251&u=

http://ld.mediaget.com/index2.php?l=en&bbls_client_id=41292208&bbl=1

http://mediaget.com/torrent.php?rid=1837&bbl=1&bbls_client_id=41292208

http://sub2.bubblesmedia.ru/go/?link=Rm8FwqngH91XJBQk7dTQX3tFVTtqVIvL/tqPjXqKUr4Bh9 brCjA6M72RSRiSP8uxXo8RE5yBIa0f6XB5334CDFb/.../txUozNAR0PW7K7jqoVRZ34IELvgSt90=&param=170DtuRxP4M=&rid=1837

http://ld.mediaget.com/index2.php?l=tr&r=ea6.net&f=the-walking-dead-survival-instinct-full-indir-pc&s=The Walking Dead: Survival Instinct Full indir - PC&bbls_client_id=41173418

http://sub2.bubblesmedia.ru/go/?link=kLKPDBiR/YgRfwIi6ajtb1NnmHt5mQamO/7gJjgSla1BBQYXjLQ3gsYhCz97kBO1XI1Sk8KW2pUZqgWgaIMNvxTpz4rMkM3yVaTifEKQPtuT1GU6q3pscPN2xU9xqjhumzBVVHaBFsuz YzaaB5WOMwCsR L6zEckkONWPCOsS/.../pl9s=&rid=1497

http://www.softportal.com/getsoft-15445-mediaget-2.html

Remove windows-7-sp1-aio-32_id760070ids2s.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.