home

3ds0485-mario-amp-luigi-dream-team-multi3-119157497.exe

Turn Key Media

The application 3ds0485-mario-amp-luigi-dream-team-multi3-119157497.exe by Turn Key Media has been detected as a potentially unwanted program by 5 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from files4.cosmicsign.info and multiple other hosts.
Publisher:
Turn Key Media  (signed and verified)

Product:
Turn Key Media

Version:
71.8.8.9338

MD5:
533e05dbfdf1fb99328c24a5ad3a1563

SHA-1:
2e9cab3f64cab64264d5ede35d9ff8d0c14b37d5

SHA-256:
6e5923e12b643b2c2d07c0c13071dec275ffb061fabeab654b18ac5124cc9e33

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 12:57:23 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Gen:Trojan.Heur.JP.3q3@ayHViyji
11.5.0.6191

ESET NOD32
Win32/DownloadAdmin.Q potentially unwanted application
8.0.319.0

F-Secure
Trojan.Heur.JP.3q3@ayHViyji
5.15.96

Norman
Gen:Trojan.Heur.JP.3q3@ayHViyji
29.03.2016 06:29:16

Reason Heuristics
PUP.DownloadAdmin (M)
16.4.15.17

File size:
892.1 KB (913,480 bytes)

Product version:
71.8.8.9338

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\3ds0485-mario-amp-luigi-dream-team-multi3-119157497.exe

Digital Signature
Signed by:
Turn Key Media

Authority:
GoDaddy.com, Inc.

Valid from:
12/9/2015 6:56:38 AM

Valid to:
12/9/2016 6:56:38 AM

Subject:
CN=Turn Key Media, O=Turn Key Media, L="Oakland ", S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
298FC8619C109945

File PE Metadata
Compilation timestamp:
1/23/2015 9:09:55 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:8is/KOFyNjSajGzyJEwzKX8lgtq/KfPoB9Q:4tFyNjSKGaKX8+tYo

Entry address:
0x4656

Entry point:
E8, 35, 9E, 00, 00, E9, 5F, 96, 00, 00, A1, 24, D4, 4B, 00, 23, 44, 24, 10, 89, 44, 24, 10, 8B, 4C, 24, 10, 85, C9, 74, 08, A1, 44, 01, 41, 00, C2, 10, 00, 8B, 54, 24, 10, 85, D2, 74, 08, A1, 48, 00, 41, 00, C2, 10, 00, 8B, 44, 24, 10, 85, C0, 74, 08, A1, 4C, 00, 41, 00, C2, 10, 00, 8B, 4C, 24, 10, 85, C9, 74, 08, A1, 58, 01, 41, 00, C2, 10, 00, 8B, 54, 24, 10, 85, D2, 74, 08, A1, 38, 01, 41, 00, C2, 10, 00, 8B, 44, 24, 10, 85, C0, 74, 08, A1, 34, 01, 41, 00, C2, 10, 00, 8B, 4C, 24, 10, 85, C9, 74, 08, A1...
 
[+]

Entropy:
7.9650  (probably packed)

Code size:
57 KB (58,368 bytes)

The file 3ds0485-mario-amp-luigi-dream-team-multi3-119157497.exe has been seen being distributed by the following 11 URLs.

http://files4.cosmicsign.info/dl-pure/1108968/.../?bc=1108968&checksum=680331&filename=flash_update.exe&cb=-1132843518&usefilename=true&executable=1199659

http://files4.filefly528.com/dl-pure/1125224/.../?bc=1125224&checksum=118628937&filename=The-Sims-FreePlay_setup.exe&cb=-198245280&usefilename=true&executable=1199659

http://files4.equipmentportfolio.info/dl-pure/1190981/.../?bc=1190981&checksum=120627905&filename=minecraft_10232.exe&cb=-1166472887&usefilename=true&executable=1199659

http://cdn1.routineinfo.com/dl-pure/1087988/.../?bc=1087988&checksum=120636325&filename=five_nights3.exe&cb=523254982&usefilename=true&executable=1199659

http://files4.displayphone.info/dl-pure/1191803/.../?bc=1191803&checksum=780811&cb=1886158928&usefilename=true&executable=1199659

http://files4.cosmicsign.info/dl-pure/1108968/.../?bc=1108968&checksum=680305&filename=flash_update.exe&cb=-940854645&usefilename=true&executable=1199659

http://files4.computingaccess.info/dl-pure/1187543/.../?bc=1187543&checksum=851977&cb=-2104670621&usefilename=true&executable=1199659

http://files4.computingaccess.info/dl-pure/1187543/.../?bc=1187543&checksum=5474351&cb=1372278148&usefilename=true&executable=1199659

http://files4.pclaboratory.info/dl-pure/1190417/.../?bc=1190417&checksum=120850933&filename=3DS0250-Zero-Escape-Virtues-Last-Reward.exe&cb=1727267648&usefilename=true&executable=1199659

http://files4.systemadapter.info/dl-pure/1196157/.../?bc=1196157&checksum=2894719&cb=1959821284&usefilename=true&executable=1199659

http://files4.filefly528.com/dl-pure/1125224/.../?bc=1125224&checksum=119326231&filename=Hungry-Shark-Evolution_setup.exe&cb=762886877&usefilename=true&executable=1199659

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.