home

{blocked}.exe

SimpleFiles Installer

New Monte Inc

The application {blocked}.exe by New Monte Inc has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 390, 1

MD5:
c89732b60044449b9a194cb0ee3bb19a

SHA-1:
9e4584bb25067e7f31139b756e5719e865ad7c31

SHA-256:
9ea6c22a9e07524df384a084dc8a58b5a2e28b113174bbcdb8264750e81e6bf7

Scanner detections:
5 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/23/2024 4:43:20 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Downloader.Gen4
7.11.196.118

AVG
Generic
2015.0.3257

Bkav FE
HW32.Packed
1.3.0.6267

Reason Heuristics
PUP.Installer.NewMonte.f
14.12.17.14

VIPRE Antivirus
Threat.4783941
35418

File size:
3.7 MB (3,876,312 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\dat-ass-jab-comix-complete_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 7:00:00 PM

Valid to:
12/6/2016 7:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
11/24/2014 11:03:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:RKy+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYC:cOh3SQGPL+71l3CO4YC

Entry address:
0x6F3BBA

Entry point:
E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1...
 
[+]

Entropy:
7.9285

Packer / compiler:
Xtreme-Protector v1.05

Code size:
968.5 KB (991,744 bytes)

The file {blocked}.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GBdladiGhVmYd SJWSDEP1jWpRj5QbWoGJCjy8km4v NRvFePbbBTkyyxfupgHE 3FVwHUy01GhY8bVI1zLFeIOERkhHsaIJJkHBWMaPMrwS2hMWxw6D05LKkubFLMNmNW419kQf4HcF7xD2wfwAFxE9MWU2bIGVFT2whRfOYtCjfS41wW2OpdLtTVVj7 vhoho EfMLurc2jhq3tX/ap8S WRYU uxwsFvtkwTNaZaEDWhVkb3dNQGYyOXLDGiw/kzvcRvM30Ru/NqRmkJbsdqESapvVs6 HzKbnp1S7zvYNnkP/.../my8b4NhvGuw=

Remove {blocked}.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.