home

copernic-desktop-search-420-build-6414_id4669373ids1s.exe

mediaget-installer Module

Banner LLC

The application copernic-desktop-search-420-build-6414_id4669373ids1s.exe, “MediaGet installer” by Banner has been detected as a potentially unwanted program by 12 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from torr.mediaget.com and multiple other hosts.
Publisher:
MediaGet LLC  (signed by Banner LLC)

Product:
mediaget-installer Module

Description:
MediaGet installer

Version:
1.0

MD5:
7d4ba508b10668f442184365eaf2ba10

SHA-1:
53822e220bd8b2a1282d1c9b0baedc6203a2f2f5

SHA-256:
525a61d2f58cc7c89eb01b6bc182a84f5c5eb4505bf51e23124f9a78e0ff93a7

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 3:13:15 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/MediaGet.Gen5
7.11.177.172

AVG
Banne
2015.0.3324

Baidu Antivirus
Adware.Win32.MediaGet
4.0.3.14112

Dr.Web
Program.MediaGet.21
9.0.1.0285

F-Prot
W32/MediaGet.C.gen
v6.4.7.1.166

G Data
Win32.Adware.MediaGet
14.10.24

Kaspersky
not-a-virus:Downloader.Win32.MediaGet
14.0.0.3114

Malwarebytes
PUP.Adware.MediaGet
v2014.10.12.02

McAfee
Artemis!6ECB8FDDB6A6
5600.6958

Qihoo 360 Security
Win32/Virus.Downloader.e90
1.0.0.1015

Reason Heuristics
PUP.Installer.Banner.v
14.10.12.2

Sophos
MediaGet
4.98

File size:
572.5 KB (586,272 bytes)

Product version:
1.0

Copyright:
Copyright (c) 2011 MediaGet LLC

Original file name:
mediaget-installer.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\copernic-desktop-search-420-build-6414_id4669373ids1s.exe

Digital Signature
Signed by:
Banner LLC

Authority:
COMODO CA Limited

Valid from:
3/26/2014 1:00:00 AM

Valid to:
3/26/2017 12:59:59 AM

Subject:
CN=Banner LLC, O=Banner LLC, STREET="lit.A, pom. 7N, 21 Serebristy bul.", L=St.Petersburg, S=Russia, PostalCode=197341, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
75D61BEBB47652BF2C5DF2DDF44F0E3A

File PE Metadata
Compilation timestamp:
10/10/2014 1:13:51 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:YCW4034Rf3ZJHVW7ZktVzLMp3p1bRBKqtv/mD5ytv30bLc3ZeU:YC3f3ZJHVW7ZktJLQ51bRBlNukv30bY7

Entry address:
0x146E40

Entry point:
60, BE, 00, E0, 4E, 00, 8D, BE, 00, 30, F1, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.9245

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
360 KB (368,640 bytes)

The file copernic-desktop-search-420-build-6414_id4669373ids1s.exe has been seen being distributed by the following 18 URLs.

http://torr.mediaget.com/torr.php?r=fileindir.com13&s=Kelebegin Rüyasi Full izle | Yerli Sinema izle, &f=Kelebegin Rüyasi Full izle | Yerli Sinema izle,

http://mg.bubblesmedia.ru/index.php?redirect_url=http://.../index2.php?l=es&r=compucalitv.com&bbls_client_id=93630670&bbl=1

http://sub2.bubblesmedia.ru/go/?link=OYNIkIWp6P0ikkAF/s6x8NcNDEkAYErKWnmaL6K9TpkN0mY6al1d T4hFU4bCyKite09iI7sdeyFP52nazdZMJB0 ZlcWsYywtzQ9SfUWFRcL8BOOrBtM2fqlc/XSS4WvFed8ZoMsuwVITr5nPZEhGogiB7DvTKrBF1Ze9ACW5Jw8elBudezASyYeCHd&param=nXeDA6ljNi8=&rid=1181&s=????? ???????-????: ??????? ?????????? 2014 - ??????? ??????? ????? ?????????&r=katushka.net&f=????? ???????-????: ??????? ?????????? 2014 - ??????? ??????? ????? ?????????&cs=windows-1251&u=http://.../download.php?id=146843

http://sub2.bubblesmedia.ru/go/?link=KLCDPmJvwAMpV16waNhgkCnGPaupp/pS5HFlyGS87HWOgXdLc/SN00e86QJI6sWJ0XHttSq0om0uaHZKICDtJ97WWJnd57yiQkw2GVL4sCj5c79mAySGIMO17c9VOKvZBQP94wc XL23TmcRFSWjGh8Uyac279dxj5AmsVA5pIpxl8X0Ybu3IXVYMQ==&param=Ktuij3/rgLE=&rid=429&s=VA - Recopilaci?n De 103 ?xitos De Los 80 Y 90 - 2014&r=torrentestrenos.com&f=VA - Recopilaci?n De 103 ?xitos De Los 80 Y 90 - 2014&cs=UTF-8&u=redirect.php?file=25168&url=http://www.torrentestrenos.com/uploads/torrents/.../

http://mg.bubblesmedia.ru/index.php?redirect_url=http://.../index2.php?l=es&r=compucalitv.com&bbls_client_id=93663904&bbl=1

http://sub2.bubblesmedia.ru/go/?link=LxLE mVjMsiIxDNelDujwpoznUUeBRQ5XtfZC/.../za8sORrVvVJvpAt1vXXXZ1IzhDJCaBN1DzfgngSDutMEynBmaKycpkUU&param=J5udFUWyd2s=&rid=2314&s=FIFA 2015 INDIR | indir Tek Full Download&r=indir-tek.blogspot.com&f=FIFA 2015 INDIR | indir Tek Full Download&cs=UTF-8&u=&fu=

http://sub2.bubblesmedia.ru/go/?link=FwnMMKNepy8FCquQ8jGBxaOCBL/EgtqB3tv/FKX5 53LrhRZDg6WvBtTkyUopKz/.../Hq6uwkR8B8Ulhz2tBs2ecN7vH RrTwdpB6JbK00vnI56zhxyT4a&param=CheOiRlU2kI=&rid=1089&s=&r=moova.ru&f=&cs=UTF-8&u=&fu=

http://mediaget.com/.../

http://sub2.bubblesmedia.ru/go/?link=9FY2V1VjKPvyPzCaHVgCx5NXZ8SHYMfBxQ ww0QmaFXPNRVMa4Ov9kmbrxJyM3zf2sUZ2jkIDnk/2kM/dR18E8vXiyysEeEWxFITJOmBEj6VTYrVCz7rFjOBjPMHf8T/GvR2omy6Ah7Xkqu8gwREzMpkugp6d3JhFpvVnQuFUdlLvTdlqv1qMLc 4xep&param=pbqBRuDHh Q=&rid=2089&s=??????? ????? ????? / In Time (2011) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&r=fast-torrent.ru&f=??????? ????? ????? / In Time (2011) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&cs=utf-8&u=&fu=http://www.fast-torrent.ru/download/torrent/.../160863.torrent

http://sub2.bubblesmedia.ru/go/?link=bkp4W/jR q9ysYzn0QOqPUA7AWn5OQHpuuLpPPEwHei8b7ZEX6opjyTq4WwlM0DJGS0K3CYf54IvWrAhCNNe CY2lc3/DqRvdNJSEgvBNfqK9dqDY/WnVjiTKktgzAtNokTUip/cocLXemRJ1trYqm02N1lkDwPxyUxqj4dxKYzuf/CHptRQ2SZ4eWoR&param=qk4/bJLjBto=&rid=2089&s=??????? ????? ???? ???? / Let's Be Cops (2014) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&r=fast-torrent.ru&f=??????? ????? ???? ???? / Let's Be Cops (2014) - ???????? ??????? ?????? ??????? ?????? ? Fast torrent ??????? ?????? ????????? ??? ???????????&cs=utf-8&u=&fu=http://www.fast-torrent.ru/download/torrent/.../undefined.torrent

http://ld.mediaget.com/index2.php?l=tr&r=ea6.net&f=euro-truck-simulator-2-hz-limiti-kaldrma-modu-/.../-Hilesi&bbls_client_id=93506751

http://mg.bubblesmedia.ru/index.php?redirect_url=http://ld.mediaget.com/index2.php?l=tr&r=ea6.net&f=euro-truck-simulator-2-hz-limiti-kaldrma-modu-/.../-Hilesi

http://torr.mediaget.com/torr.php?r=ea6.net&s=Euro Truck Simulator 2 Hiz Limiti Kaldirma modu /.../ Hilesi

http://ld.mediaget.com/index3.php?reinstall=true&os=windows&r=google&bbls_client_id=93282043

http://mg.bubblesmedia.ru/index.php?redirect_url=http://.../index3.php?reinstall=true&os=windows&r=google

http://www.mediaget.com/download.php?ref_id=google&os=windows

http://ld.mediaget.com/index2.php?r=CBN_728_blue_orange

http://mediaget.com/torrent.php?r=rsload.net&s=Copernic Desktop Search 4.2.0 Build 6414&f=Copernic Desktop Search 4.2.0 Build 6414&cs=windows-1251

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.