home

doc_files.exe

Gurogelito

LAM Proactive And Investments Ltd

The application doc_files.exe, “Gurogelito Setup ” by LAM Proactive And Investments has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from r.srvtrck.com.
Publisher:
LAM Proactive And Investments Ltd  (signed and verified)

Product:
Gurogelito

Description:
Gurogelito Setup

Version:
1.6.2.8

MD5:
85fe2f5dc5a7f736b4974d8964059afa

SHA-1:
39ca737a330d71ed43c11ee6a5388417badc6b22

SHA-256:
d98d025994a84e624a4b244a852cdd1a4f168b36bc99763ac34eb05011d9fa83

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
5/21/2024 4:52:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.LAMProac.Installer (M)
16.7.11.21

File size:
1021.9 KB (1,046,464 bytes)

Product version:
4.1.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Nezavisno od jezika

Common path:
C:\users\{user}\downloads\doc_files.exe

Digital Signature
Signed by:
LAM Proactive And Investments Ltd

Authority:
GlobalSign nv-sa

Subject:
CN=LAM Proactive And Investments Ltd, O=LAM Proactive And Investments Ltd, L=Herzliya, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112169523491FA6C7A30991E1A2D83769865

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:4iRJjHDU/7ohKYf4DmheRf8RlN4FGmbEMTKZUGJdXt:VXHDoKPAi4ERlNYGaEMTKZUSdd

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file doc_files.exe has been seen being distributed by the following URL.

http://r.srvtrck.com/v1/redirect?url=http://www.newclearchuckle.com/HVH51JGRavGy0Lb4ZUujWKH4tQxy_2MaoHF4P8KCWxvbr7LdreSp9Wt8eRd7Z2NlRLbsSTwHtjzfWvEkU UaqqKAd152UITCgKE3fwewS8jv1UOgDIFdF4WfB6rfM2h49DJBSmbyc3f057WKg7jTEcxo0UaCwCvDCc vwZLDouso3FiU_R5hERi3v6NGOyQlumz9Yea2cmSJVuNnH2y2Aibi6KHX3G261QVF3cw35xiIh dQrfBtccVik64x0ZQyAd4IcxcqG6ZO83NB1UYSVWwgk LmOwGPkFls4nHpQFRuzwIx6JiqmW8ABAz8OSkSvwRWXYZoGQFZXL8_vXdYBf_b E6yIV051mtj9bkf34YepI7GGANgLtpuWzf5eV0PVi g8dXIKlOxGERvzzEmz1mLQJLbVcy7n13MghKAT8WcwOpJpUtQjbvpCNp84KM25hWR7UW3cTKAvWrrNgucDI2UJmiUxUcsJKss_VFRBSgOnJs75XI=-G3MAAORte69pY0lripiEgRWWJ6ccOLSy1jz8duGD8MFtCB6_4BCiryNu4 lbqNXCDUg9H Sj3euE5jfnNbW2fE53Z4iiBRfhnKDpiDTNaW0NX7AgBw==-e&type=url&abtag=abp:false&ykuid=qffhleluy65naahcm1x9niqy0m&api_key=7d7a809da5bdbc602db5885fcc963e0f&site_id=df0dd5d782e5408d9fc24f65ce398b3e&tid=a96b45db-796a-49b8-89df-15e690ef08a7&dch=gaia&tna=gaia&tv=0.95&title=Doc Files&refr=http://.../&page=http://.../pr

Remove doc_files.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.