home

64_bit).full.exe

Cool Mirage ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application 64_bit).full.exe by Cool Mirage ltd has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities.
Publisher:
Cool Mirage ltd.  (signed and verified)

MD5:
5a5260f0d48081857afb4bf6cc7e3027

SHA-1:
3334474d70b0b1f98893465ecad6f8a2be2f7529

SHA-256:
d9cce29f8ad642aaf19bb21a6aafb7b33022b14f8f8c3a9a4e679cbe83ae92fe

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
4/26/2024 11:50:03 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.CoolMirageltd.L
14.8.7.18

File size:
222.7 KB (228,032 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\64_bit).full.exe

Digital Signature
Signed by:
Cool Mirage ltd.

Authority:
COMODO CA Limited

Valid from:
11/14/2012 12:00:00 AM

Valid to:
11/14/2014 11:59:59 PM

Subject:
CN=Cool Mirage ltd., O=Cool Mirage ltd., STREET=ogarit 39, L=tel aviv, S=tel aviv, PostalCode=69016, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FC28659CC8073606EF4D09A1994B1AD0

File PE Metadata
Compilation timestamp:
12/5/2009 10:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:Es87F3dqTzmkn/OlmH9DH7BEBijOz5TNvVgohyWjoI:YZk2A/qgMiS/vVdhykoI

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Code size:
23 KB (23,552 bytes)

The file 64_bit).full.exe has been seen being distributed by the following URL.

http://www.thetorrn-tv.com/download/product_download.php?pub=1337x&fileName=http://torrage.com/torrent/.../64 bit).Full.DVD-XFORCE

Remove 64_bit).full.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.