home

{blocked}.exe

SimpleFiles Installer

New Monte Inc

The application {blocked}.exe by New Monte Inc has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 390, 1

MD5:
41589cb76151a9542f7b7ea42e0c5233

SHA-1:
410fbb873669a850de8cc0698333eaabc97cfcf2

SHA-256:
a97bfedc4d89f517da34f303f6d5b103566ac19538a4e446f75e8f1f20ef0105

Scanner detections:
6 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 10:15:23 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Downloader.Gen4
7.11.196.118

AVG
Generic
2015.0.3257

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.8.5.0

Reason Heuristics
PUP.Installer.NewMonte.Y
14.12.17.14

VIPRE Antivirus
Threat.4783941
35418

File size:
3.7 MB (3,876,280 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\dat-ass-comic_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 7:00:00 PM

Valid to:
12/6/2016 7:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
11/24/2014 11:03:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:xKK+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYM:8mh3SQGPL+71l3CO4YM

Entry address:
0x6F3BBA

Entry point:
E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1...
 
[+]

Entropy:
7.9285

Packer / compiler:
Xtreme-Protector v1.05

Code size:
968.5 KB (991,744 bytes)

The file {blocked}.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GBdladiGhVmY5wR/GSZXrP6HYm8eF8JfbldirukiZ8pYFqE DZaBLmyy9LqoUNS66qDlbdyk1ClpwJXIFiLEqVdRJ/wS8YKp1uFHfKN/cqj0rvPXNttiJseO4 e0/2KiJG A82Xf8VS07wH3ZF0RchYPRUUlzKGntewxNLKuwQQ3iGpEQtyNldPYK9DX/yvQp786Jua/.../O3m2qXIv8NdjKQ==

Remove {blocked}.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.