62ee1abf-e6c9-473b-9385-63ac3879d464.exe

Torpedo

Evangelion Group

This potentially unwanted Internet browser extension is built upon and distributed using the free Crossrider platform and will deliver advertisements to the web browser in various formats such as banner, text hyper-links, inline text and transitional ads. The application 62ee1abf-e6c9-473b-9385-63ac3879d464.exe by Evangelion Group has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Evangelion Group  (signed and verified)

Product:
Torpedo

Version:
1.0.0.0

MD5:
f5e04c837ee18e09e47bf548e19e1a26

SHA-1:
8f624d57a6707817e1402b367e295f53a297fb03

SHA-256:
28eadf437894de35d69295a2f06ad7e0330615f7c1717009edf515b4f4df1b6b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/31/2020 7:50:00 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Brightcircle (M)
17.3.12.4

File size:
31.9 KB (32,624 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2014

Original file name:
TorpedoChNet4.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\hdtubev1.6v16.09\62ee1abf-e6c9-473b-9385-63ac3879d464.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
7/28/2014 5:30:00 AM

Valid to:
7/29/2015 5:29:59 AM

Subject:
CN=Evangelion Group, O=Evangelion Group, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0095E2A1168FF10F1D56CF5FFE4ABC7450

File PE Metadata
Compilation timestamp:
8/18/2014 5:36:32 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

Entry address:
0x82AE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.4368

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
25 KB (25,600 bytes)

Scheduled Task
Task name:
62ee1abf-e6c9-473b-9385-63ac3879d464

Trigger:
Logon (Runs on logon)


Remove 62ee1abf-e6c9-473b-9385-63ac3879d464.exe - Powered by Reason Core Security