» bob_and_tom-dis_man_mp3_downloader.exe
Overview
Analysis
File Details

bob_and_tom-dis_man_mp3_downloader.exe

SimpleFiles Installer

New Monte Inc

The application bob_and_tom-dis_man_mp3_downloader.exe by New Monte Inc has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer.

File name:

Publisher:

New Monte Inc (signed and verified)

Product:

SimpleFiles Installer

Version:

1, 0, 390, 1

MD5:

08fb34e9fe1921a12bc4e3d852aea919

SHA-1:

2d8d8bda53375cb04a1ae7ee3925d93b1aa1dc60

SHA-256:

e1156da9817bda20cde63b2b98c267b832626384a7f20a2d464c389f8221803d

Scanner detections:

7 / 68

Status:

Adware

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/19/2024 11:21:09 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/Downloader.Gen4

7.11.197.26

AVG

Generic

2015.0.3253

ESET NOD32

Win32/ExpressDownloader.K potentially unwanted application

7.0.302.0

F-Secure

Gen:Variant.Adware.Mplug.21

5.13.68

IKARUS anti.virus

PUA.Expressdownloader

t3scan.1.8.5.0

Reason Heuristics

PUP.Installer.NewMonte.c

14.12.22.3

VIPRE Antivirus

Threat.4783941

35418

File size:

3.7 MB (3,875,520 bytes)

Product version:

1.0.0.1

Original file name:

SimpleFilesInstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SimpleFiles

Language:

English

Common path:

C:\users\{user}\downloads\bob_and_tom-dis_man_mp3_downloader.exe

Digital Signature

Signed by:

New Monte Inc

Authority:

DigiCert Inc

Valid from:

12/1/2013 6:00:00 PM

Valid to:

12/6/2016 6:00:00 AM

Subject:

CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:

CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata

Compilation timestamp:

11/24/2014 10:03:33 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

98304:EKK+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYk:Zmh3SQGPL+71l3CO4Yk

Entry address:

0x6F3BBA

Entry point:

E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1... 
[+]

Entropy:

7.9285

Packer / compiler:

Xtreme-Protector v1.05

Code size:

968.5 KB (991,744 bytes)

Remove bob_and_tom-dis_man_mp3_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.