home

deal boat.exe

Enchanted Apps

This is the installer application for a 50onRed advertising supported software package (displays ads in the browser and may hijack the home and search pages of the web browser). The application deal boat.exe by Enchanted Apps has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Nullsoft Install System installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.updatesrv.com.
Publisher:
Enchanted Apps  (signed and verified)

MD5:
b41947c97694cc0073c9937772c2c1b6

SHA-1:
f8a39ed443e93045b2b0eb0fb4f250a7d1d86e16

SHA-256:
437291ec8f8b6c77ec63ae221c758b9adcf6f8a62cdb8311e7254fe8eff4b951

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 9:07:11 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.50OnRed.EnchantedApps.Installer (M)
16.2.3.0

File size:
487.6 KB (499,304 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\deal boat.exe

Digital Signature
Signed by:
Enchanted Apps

Authority:
Thawte, Inc.

Valid from:
6/3/2013 5:00:00 PM

Valid to:
6/4/2014 4:59:59 PM

Subject:
CN=Enchanted Apps, O=Enchanted Apps, L=Philadelphia, S=Pennsylvania, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
0AD2FFB9C41506FA798B6D0457ECFD21

File PE Metadata
Compilation timestamp:
2/19/2012 7:01:49 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
6144:9saocyLC2r+g0uSUo2zooBflKlwVuEnx+LCc2JtcPCBXnukCfCO4fscb3o5Zv:9tobRz0OioBfIpEYLChJACduhaHfsa32

Entry address:
0x4327

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 93, 42, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 94, 42, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 94, 42, 00, 56, A3, 40, 7B, 42, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 7B, 42, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, 94, 42, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.8951  (probably packed)

Code size:
34.5 KB (35,328 bytes)

The file deal boat.exe has been seen being distributed by the following URL.

http://www.updatesrv.com/.../.eJw1jMEKgCAQBf_lnb2YkebPxEYWkqSsQVD07y1C1zcz7wGVMsUFXne2twon1R0e8agnpRQYCqVhp4Xe-QjN7t1gOqN-b1oTbRXejFpBli3IR-G8SD5zvmpgofr9AHGXIo8._R2Ds9Bfe-XZ1sD1bU9YQkx1_Ug

Remove deal boat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.