home

6_offer_4.exe

Moozy

Greatelsoft Trading Ltd

The application 6_offer_4.exe, “Moozy Setup ” by Greatelsoft Trading has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.revenyou.com.
Publisher:
Greatelsoft Trading Ltd  (signed and verified)

Product:
Moozy

Description:
Moozy Setup

MD5:
a76a6349387fea31f4c56e0807ce446e

SHA-1:
d0ab2e15d63ae585240ef1a312654c135e355944

SHA-256:
345f1fd8788ad6d29b7af2737e9ba894814e4e656a04be4d3e3be5b5525ef1bf

Scanner detections:
17 / 68

Status:
Adware

Analysis date:
4/26/2024 10:23:13 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.NMP
982

Avira AntiVirus
Adware/Agent.NMP
7.11.132.202

AVG
Generic5
2015.0.3460

Bitdefender
Adware.Agent.NMP
1.0.20.745

Bkav FE
W32.Cloda67.Trojan
1.3.0.4924

Dr.Web
Trojan.DownLoader8.57811
9.0.1.0149

Emsisoft Anti-Malware
Adware.Agent.NMP
8.14.05.29.07

F-Secure
Adware.Agent.NMP
11.2014-29-05_5

G Data
Adware.Agent.NMP
14.5.24

IKARUS anti.virus
AdWare.Agent
t3scan.2.2.29

MicroWorld eScan
Adware.Agent.NMP
15.0.0.447

NANO AntiVirus
Riskware.Win32.SearchAssistant.clxqh
0.28.0.57630

nProtect
Adware.Agent.NMP
14.02.19.01

Reason Heuristics
PUP.Installer.GreatelsoftTrading.J
14.5.29.7

Trend Micro House Call
TROJ_GEN.F47V1124
7.2.149

Vba32 AntiVirus
AdWare.SearchAssistant
3.12.24.3

VIPRE Antivirus
Adware.Agent
26658

File size:
953.8 KB (976,640 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Turkish (Turkey)

Common path:
C:\users\{user}\appdata\local\temp\6_offer_4.exe

Digital Signature
Signed by:
Greatelsoft Trading Ltd

Authority:
COMODO CA Limited

Valid from:
7/2/2013 3:00:00 AM

Valid to:
7/3/2014 2:59:59 AM

Subject:
CN=Greatelsoft Trading Ltd, O=Greatelsoft Trading Ltd, STREET="Kyriakou Matsi, 3, Roussos Limassol Tower, 6th floor, flat/office 6A, 3040", L=Limassol, S=Limassol, PostalCode=3040, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EFAAE98A631C872ADDE1E300FDF065A2

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:J3GDwwAND0MCb6VRRaC4htwWyFiXLC15wvnPdsqQ4v:JUhAh0GVRRaavOLCgvh1

Entry address:
0x9C18

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, AE, 94, FF, FF, E8, B5, A6, FF, FF, E8, 44, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, D4, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 9D, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 5A, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file 6_offer_4.exe has been seen being distributed by the following URL.

http://dl.revenyou.com/Files//Setup_product_2707.exe

Remove 6_offer_4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.