home

6t9mr.exe

exYfVP4Fa

sL3IH4

The application 6t9mr.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup. The file has been seen being downloaded from www.inditedexplanatory.webcam and multiple other hosts.
Publisher:
sL3IH4

Product:
exYfVP4Fa

Description:
tiny install

Version:
231.216.200.118

MD5:
bd2bb026245a3e80dc4c5700de924b56

SHA-1:
792a8dab6cb6a200fa1bf86878b7998929e57fcf

SHA-256:
000a8caf1836400520c7535f8d0677f2fc57b7577d1fad95d0821005621a9c45

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:
5/20/2024 5:24:32 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.InstallMonetizer (M)
16.7.17.15

File size:
916.5 KB (938,496 bytes)

Product version:
231.216.200.118

Copyright:
cZnUdcyXZZr7

Trademarks:
Trd Mark

Original file name:
m1M6Jij

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\6t9mr.exe

File PE Metadata
Compilation timestamp:
7/17/2016 10:07:52 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:9CSMcJwgA3GV32DbQ2je8Rvhpd1gthbMQ+beN/6Ka+ZaVy0M/DMVhg3Bx5:99MuA3m34agvDd1FedZZwMQ7gRX

Entry address:
0x73C9

Entry point:
E8, 00, 00, 00, 00, 9C, 83, 44, 24, 04, 0C, 9D, E9, FD, 44, 00, 00, E9, 15, FE, FF, FF, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, 08, 69, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 5F, 00, 00, 00, C7, 06, 08, 69, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, A0, 00, 00, 00, C7, 06, F0, 68, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 44, 00, 00, 00, C7, 06, F0, 68, 42, 00, 8B, C6, 5E, 5D...
 
[+]

Entropy:
7.4690

Code size:
141.5 KB (144,896 bytes)

The file 6t9mr.exe has been seen being distributed by the following 2 URLs.

http://www.inditedexplanatory.webcam/.../6t9mr.exe

http://www.inditedexplanatory.webcam/.../rbv5p.exe

Remove 6t9mr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.