home

battlefield_1942_keygen_downloader.exe

SimpleFiles Installer

New Monte Inc

The application battlefield_1942_keygen_downloader.exe by New Monte Inc has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 390, 1

MD5:
5990243ec7b12c51d67bf97d2f8918a0

SHA-1:
fbd866d038a16e1102a86948f0a8bb6f5cc0cc6e

SHA-256:
a98e89efba0a54dcd88bd126daa1f9d0c1cf0b0847f226c4cfef965d1c9bb894

Scanner detections:
6 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 8:25:32 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Downloader.Gen4
7.11.195.126

AVG
Generic
2015.0.3260

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.8.5.0

Reason Heuristics
PUP.Installer.NewMonte.c
14.12.14.20

VIPRE Antivirus
Threat.4783941
35418

File size:
3.7 MB (3,867,240 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\battlefield_1942_keygen_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 5:00:00 PM

Valid to:
12/6/2016 5:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
11/24/2014 9:03:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:8KK+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYf:xmh3SQGPL+71l3CO4Yf

Entry address:
0x6F3BBA

Entry point:
E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1...
 
[+]

Entropy:
7.9283

Packer / compiler:
Xtreme-Protector v1.05

Code size:
968.5 KB (991,744 bytes)

The file battlefield_1942_keygen_downloader.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GHVnbEpV5g3ahTbpPgejqO/ix3ub4ueOKpPCf51WIp/tVkFufbfVWhjzZO5chaGO3AQUKBix9YgY8wU4w8QBiYdxYklmAYGYB0Dy/FJKUtkHzkOT0orSJgbtAyZ1LnY3hN8gN0WvUDYAP8BXUX1wpvasQdVVffBF0A ikOM9YfQBrU7lkq0NlaIoK6HiWn/WM8t692YeWmamz6qGZQ4alqELb9OAiozmkPupk9RYGZakLSggMdjo5UTY6IXLPCilm0kfBI78rwEquKq0XSS gQ8jq37r9ot/CgO/.../cyH063h q8cjcb6Rahfj0G0T

Remove battlefield_1942_keygen_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.