» desktoptemperaturemonitor_09252014.exe
Overview
Analysis
File Details

desktoptemperaturemonitor_09252014.exe

Desktop Temperature Monitor

System Alerts LLC

The application desktoptemperaturemonitor_09252014.exe by System Alerts has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs.

File name:

Publisher:

System Alerts LLC (signed and verified)

Product:

Desktop Temperature Monitor

Description:

Application

Version:

1.24.4.0

MD5:

a8e6c8d7acf7f304feb943e8450472f9

SHA-1:

94510ac827cc67224ce01df3e82c92a5dedc131b

SHA-256:

c7d374eb5e4e5f9bc19288e2965f3acd438390d424d602a15553308b76b6de7c

Scanner detections:

6 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:

4/25/2024 4:16:48 AM UTC (today)

Scan engine

Detection

Engine version

Malwarebytes

PUP.Optional.DesktopTemperature.A

v2015.02.21.09

McAfee

Artemis!A8E6C8D7ACF7

5600.6848

nProtect

Trojan-Clicker/W32.OutBrowse.645120

14.10.28.01

Reason Heuristics

PUP.SystemAlerts

15.2.21.9

Trend Micro House Call

Suspicious_GEN.F47V1021

7.2.52

VIPRE Antivirus

Unnamed.Threat

34316

File size:

630 KB (645,120 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\desktoptemperaturemonitor_09252014.exe

Digital Signature

Signed by:

System Alerts LLC

Authority:

COMODO CA Limited

Valid from:

11/13/2013 12:00:00 AM

Valid to:

11/13/2014 11:59:59 PM

Subject:

CN=System Alerts LLC, O=System Alerts LLC, STREET=250 Park Ave Ste 504, L=Minneapolis, S=MN, PostalCode=55415, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D56696E8C583BF7F09BCCC24A2AB8310

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:sYcRyIeYpdEN7vYCilwrBYVLEukJv4v1LHZftr6dcuaCZYYg:sY2MSavYdVLEukJv4dr5trMcQTg

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9635

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

Remove desktoptemperaturemonitor_09252014.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.