home

el hijo del diablo dvdrip xvid mp3 audio latino [www subtorrents com].exe

Ivan Manov

This is a WebPick installer that bundles (with very minimal user consent) a number of adware browser extensions which inject ads in the browser. The application el hijo del diablo dvdrip xvid mp3 audio latino [www subtorrents com].exe, “Installer for MountainApp” by Ivan Manov has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the WebPick InstalleRex (Tarma) installer. The file has been seen being downloaded from applicationgrabb.net. While running, it connects to the Internet address r1.stylezip.info on port 80 using the HTTP protocol.
Publisher:
MountainApp  (signed by Ivan Manov)

Product:
MountainApp

Description:
Installer for MountainApp

Version:
2014.6.12.1603

MD5:
bc51c012a9a4c714eb96c6a40988b9fc

SHA-1:
c4e1f88bffde5e6fb8e4f0e9d57ba7323cfe6004

SHA-256:
4abb28582847166f44672bf8b9c3da96ab7bcb6ac3fcf574a781c5e1c3cef379

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses Web-Pick's 'File Product', an Installer which wraps various products and downloads and installs it silently through the process, hosted on TusFiles.

Analysis date:
4/18/2024 10:38:27 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.WebPick.Installer (M)
16.1.17.11

File size:
316.2 KB (323,816 bytes)

Product version:
1.0.0.3

Copyright:
Copyright © 2014 MountainApp

Original file name:
TSULoader.exe

File type:
Executable application (Win32 EXE)

Installer:
WebPick InstalleRex (Tarma)

Common path:
C:\users\{user}\downloads\el hijo del diablo dvdrip xvid mp3 audio latino [www subtorrents com].exe

Digital Signature
Signed by:
Ivan Manov

Authority:
COMODO CA Limited

Valid from:
9/22/2013 7:00:00 PM

Valid to:
9/23/2014 6:59:59 PM

Subject:
CN=Ivan Manov, O=Ivan Manov, STREET=Irininskaya 18, L=Kiev, S=Kiev, PostalCode=01034, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0098D22F2CDEFA00AA1A318F6903533F2B

File PE Metadata
Compilation timestamp:
3/12/2013 2:51:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:5r5bUzkuvcBYC47l2xhXcDp5xikxyI3rqrupq0FNhAna9iydforD2:5rqkuveY3fxikxyI7qSpBAna4ydfE2

Entry address:
0x14DB

Entry point:
55, 8B, EC, 81, EC, 2C, 06, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, DC, FB, FF, FF, 89, 5D, F4, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 08, 44, 40, 00, FF, 15, 70, 30, 40, 00, 8B, F8, 8D, 45, EC, 50, FF, 15, 6C, 30, 40, 00, FF, 15, 68, 30, 40, 00, 8B, F0, F7, D6, 33, F7, FF, 15, 64, 30, 40, 00, 33, F0, 8B, 45, F0, 33, 45, EC, 68, 04, 01, 00, 00, 33, F0, 8D, 85, D4, F9, FF, FF, 50, 53, FF, 15, 60, 30, 40, 00, 85, C0, 75, 41, FF, 15, 5C, 30, 40, 00, 83, F8, 78, 75, 1A, 68, A8, 32, 40, 00, E8, 43, FB, FF, FF...
 
[+]

Entropy:
7.9533

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

The file el hijo del diablo dvdrip xvid mp3 audio latino [www subtorrents com].exe has been seen being distributed by the following URL.

http://applicationgrabb.net/.../El Hijo Del Diablo DVDrip XviD MP3 Audio Latino [www SuBTorrents com].exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to r1.stylezip.info  (54.186.255.26:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.