» brothersoft_downloader_for_aqua_energizer.exe
Overview
Analysis
File Details

brothersoft_downloader_for_aqua_energizer.exe

BSdownloader Module

KORAM GAMES LIMITED

The application brothersoft_downloader_for_aqua_energizer.exe by KORAM GAMES LIMITED has been detected as a potentially unwanted program by 9 anti-malware scanners. According to AVG, this software downloads additional adware offers during setup.

File name:

Publisher:

KORAM GAMES LIMITED (signed and verified)

Product:

BSdownloader Module

Version:

1, 0, 0, 3

MD5:

1a2461f621b049499dd844022b2e788d

SHA-1:

ce3f2d6239da39fc45cb9303311c96125a313c6f

SHA-256:

212e4a3688459817f486e32479a2c381ce6bdfbbf8203ca9675ae3b1003ac403

Scanner detections:

9 / 68

Status:

Potentially unwanted

Analysis date:

4/25/2024 6:00:45 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.BSDownloader

7.1.1

AVG

Potentially harmful program Downloader.ATN

2014.0.4040

Dr.Web

riskware program Program.BrotherSoft.18

9.0.1.05190

ESET NOD32

Win32/BSDownloader potentially unwanted application

7.0.302.0

F-Prot

W32/Agent.TR.gen

4.6.5.141

Malwarebytes

PUP.Optional.BSDownloader

v2014.10.22.07

NANO AntiVirus

Riskware.Win32.BrotherSoft.cvlwba

0.28.2.62841

Reason Heuristics

PUP.Optional.KORAMGAMESLIMITED.j

14.10.22.18

VIPRE Antivirus

Threat.4150696

33706

File size:

658.2 KB (673,992 bytes)

Product version:

1, 0, 0, 3

Original file name:

BSdownloader.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\brothersoft_downloader_for_aqua_energizer.exe

Digital Signature

Signed by:

KORAM GAMES LIMITED

Authority:

VeriSign, Inc.

Valid from:

11/8/2012 12:00:00 AM

Valid to:

1/7/2014 11:59:59 PM

Subject:

CN=KORAM GAMES LIMITED, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=KORAM GAMES LIMITED, L=HongKong, S=HongKong, C=HK

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

6DE680510AEC828B17AC57B14D7A0CE3

File PE Metadata

Compilation timestamp:

3/28/2013 3:24:33 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:+Z5vrSGq8r8bH12zt9kIl7lVTMtmx+s9Er2cDsFr+ZiltVBOlvVG7gBllggGW5Hi:+T3lYb8zIXYrFrFsSQdrVxjeZ

Entry address:

0x7C6EB

Entry point:

E8, 05, 05, 00, 00, E9, 37, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 55, 33, FF, 33, ED, 8B, 44, 24, 14, 0B, C0, 7D, 15, 47, 45, 8B, 54, 24, 10, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 14, 89, 54, 24, 10, 8B, 44, 24, 1C, 0B, C0, 7D, 14, 47, 8B, 54, 24, 18, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 1C, 89, 54, 24, 18, 0B, C0, 75, 28, 8B, 4C, 24, 18, 8B, 44, 24, 14, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 10, F7, F1, 8B, F0, 8B, C3, F7, 64, 24, 18, 8B, C8, 8B, C6, F7, 64, 24, 18, 03, D1, EB... 
[+]

Entropy:

6.6867

Code size:

503.5 KB (515,584 bytes)

Remove brothersoft_downloader_for_aqua_energizer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.