home

clash of clans.exe

Ronen Kvurt

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application clash of clans.exe by Ronen Kvurt has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from profficer.org.
Publisher:
Ronen Kvurt  (signed and verified)

MD5:
a433290228baed95cc07fd5ae8b76bc0

SHA-1:
2a4b68b483c67c6a76f0c81dfc1ae2356a03efd1

SHA-256:
fae733f86656fb6f7ed8fefdda6128a3b12b827fbf060e70bc731a70fef56943

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/23/2024 11:48:37 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick.RonenKvu (M)
16.6.9.21

File size:
1.1 MB (1,121,640 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\clash of clans.exe

Digital Signature
Signed by:
Ronen Kvurt

Authority:
Unizeto Technologies S.A.

Valid from:
5/14/2014 3:13:06 PM

Valid to:
5/14/2015 3:13:06 PM

Subject:
E=ronenkvurt@yahoo.com, CN=Ronen Kvurt, O=Ronen Kvurt, C=IL

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
2FCC7E9A4043746064F138856B04DABB

File PE Metadata
Compilation timestamp:
12/24/2012 4:34:23 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:ARNf0l5SL/RrHb05j38WCW4ioHRkuCdM:kNf0laRHboSW4iECW

Entry address:
0xB5D9B

Entry point:
E8, FC, 13, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, B6, 4F, 00, E8, 0F, 19, 00, 00, E8, C9, 15, 00, 00, 0F, B7, F0, 6A, 02, E8, 8F, 13, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 3E, 03, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.4263

Code size:
748 KB (765,952 bytes)

The file clash of clans.exe has been seen being distributed by the following URL.

http://profficer.org/hp/?q=CQXF6DwtC0BCPOQIKEu36LYBYa0wx/P2mIxY8KvVvnTuua0QoR/p4ZO4vo7Ur 0MwTLlxA ZrslprjuuR2pyDTugQTa/u1V oXjiwSgVkNkybyYzm7eenXozpmO8yWgVlTaMBQmdRa3tUUb2kv RnRFuXpjHTCbyCC9k0E0P9UpVh76OXRHO8Fb9CsSQxng2LI0sElXeZW0TZmYFh5pGfD74iEhShsG6avbx5YtY6DK4elBYXLHYqKyAMQWUgVxGNTyebn ZVqP4VBLg3z E33Ma4Ih9XB0MySckb 3bsg/ IXkG71pbHd4MXM8cJQcyRSz9BDEPIA7wH 89TQWeYUEQV3o8s a88poQiInxLSz/em9zQbOtWOOYG4P2ZpnoHob5ux5I29yxL BGq3MPObE1vSBfTmXzawXf/rKhgok/ZlXOs73XXPL1H5FRJltsxVnmtFGxfwjaksE2gvpSaPl5gI4hsnaCVXyqSvjZ9lXE3CzxOVoe8MV035SyTL7RZ0Htau1gLcQlhl 5ziWxZIyvaxKn8Hb56Q8tis03Z vzCe4nw7vXahkju/ABCaXR1S5Q0U3n3O1SL5T5wL0/pU PnQS2bbOYgJkkfWOM2T qVFMH5KbKe Ipi2SAIwYit0iihASUZpXCpGIOpnOeis1YRWreC3OCr6w98IDqt0aj raAWmG4s77j8Mf8hgMqR/mpEs u4y44Ixru7vE5SlZtU212E8lEHFwqgmP/GQlFsdVDqdOapGh5EACwf/RcmS8I pkZEyXQiIxRhiXVPuSEY/MeKpmt1O4OgCvLz9Wmn zdFRo52D5DerKbXnl00CsqU5pnyFYzah4WqZNs52wMIZQjVKAe/NiRcIf/UrtasmBqrGa H9k//zByeRSZWB9t2z5flidUxJy4A0AG/I9s7O0FYA6/.../MfQWhYgzx6jcRaC8Wcc

Remove clash of clans.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.