home

ffhc_kasumi_rebirth_3.1_free_download.rar_downloader.exe

GoForFiles Installer

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application ffhc_kasumi_rebirth_3.1_free_download.rar_downloader.exe by Righway Technologies, Inc has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dw901.go-for-files.biz.
Publisher:
http://goforfiles.com  (signed by Righway Technologies, Inc)

Product:
GoForFiles Installer

Version:
1, 0, 386, 1

MD5:
f450bcb5d4c4add370fd0a9dda70fe4e

SHA-1:
9c7e339a0de79b4e9b0d2111d6e95d0e4e35763e

SHA-256:
37e3c5814e407b2698b4469fb14f1947c14074cd98973d0d61fe141bf55a6817

Scanner detections:
24 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/24/2024 6:49:40 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Strictor.63674
795

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Generic
2014.09.24

Avira AntiVirus
APPL/Downloader.Gen4
7.11.188.92

avast!
Win32:Dropper-gen [Drp]
2014.9-141201

AVG
Righway Technologies
2015.0.3281

Bitdefender
Gen:Variant.Strictor.63674
1.0.20.1675

Comodo Security
Application.Win32.EDown.FTVP
20178

Dr.Web
Adware.Downware.4798
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Strictor.63674
8.14.12.01.12

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted application
7.0.302.0

F-Prot
W32/A-8e7708c5
v6.4.7.1.166

F-Secure
Gen:Variant.Strictor.63674
11.2014-01-12_2

G Data
Gen:Variant.Strictor.63674
14.12.24

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.7.8.0

K7 AntiVirus
Unwanted-Program
13.185.14098

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.2862

Malwarebytes
PUP.Optional.Downloader
v2014.12.01.12

MicroWorld eScan
Gen:Variant.Strictor.63674
15.0.0.1005

NANO AntiVirus
Trojan.Win32.Agent.dfgvgd
0.28.2.62286

Reason Heuristics
PUP.Installer.RighwayTechnologies.s
14.11.24.0

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Threat.4925438
35010

Zillya! Antivirus
Downloader.Agent.Win32.221447
2.0.0.1930

File size:
3.7 MB (3,911,784 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://goforfiles.com (C) 2014

Original file name:
GoForFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\ffhc_kasumi_rebirth_3.1_free_download.rar_downloader.exe

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
11/20/2014 3:29:03 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:Ljnss4yYiTB1TzKwRUn0iy4mPljnDDUBm0CMhk:Hs9iTB1TzXO0YClj6Rk

Entry address:
0x6BB95A

Entry point:
E9, C0, 08, 00, 00, C6, 04, 24, 83, 66, 0F, BA, E0, 0F, E9, C3, 52, 01, 00, C6, C6, 00, FF, 74, 24, 04, 8D, 64, 24, 2C, 0F, 84, 21, 82, 01, 00, B0, 8C, 8D, 04, 93, 55, E8, 02, 1F, 00, 00, 66, 0F, B3, D8, 27, 89, D0, 00, C0, F6, D0, 83, C7, 01, F6, D0, C6, 44, 24, 04, 93, 1C, 4E, 8A, 07, 66, F7, C6, 83, 6B, 66, 0F, BA, E3, 0B, 84, C0, 60, 8D, 64, 24, 28, 0F, 84, BD, 86, 01, 00, 68, 63, 65, B4, D7, 60, 2C, 30, E9, 76, DF, 07, 00, 7B, D3, 5B, EA, D7, F7, CF, 0D, 48, E0, 49, A6, 0B, D3, 7E, 65, E5, 74, C9, 66...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
782.5 KB (801,280 bytes)

The file ffhc_kasumi_rebirth_3.1_free_download.rar_downloader.exe has been seen being distributed by the following URL.

http://dw901.go-for-files.biz/j5GjUWrT4lBnx7hSY5OjJmzVpzN66 plJ 7PX tyjdxu4s7TbGNdVS1n3leq8xSGu3DXwLWwV8Hwo4aWIFlTgfVMUFw1nkaNIBjGjineOdzzzPzIGF/.../Fk0q80jNaL1LwKh9XVU9eooFojLIFTpl2ND7Z9rX9KfbFvVg1Bfntc7FY7JALzD3w61lfNFsMKjTOie80CjYPgf8DO24f1v4 aobbvukjWr7ZhUqrbFfNvwyDmJ cUe2rrFVZ3EzEiC 9RLx5vnR8PO

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.