home

findingdiscount.exe

The application findingdiscount.exe has been detected as a potentially unwanted program by 24 anti-malware scanners. This executable runs as a local area network (LAN) Internet proxy server listening on port 47574 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host.
MD5:
ddc0fd67c1ac9d4c1dc89c430121cbf4

SHA-1:
4b767f0ea24d77e2ad7c232d76f0041f18b21ad5

SHA-256:
89a7918a5b1bd88ada9d221bb751106a4373d029ba9b70f506078d87aa988e85

Scanner detections:
24 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 12:11:07 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Generic.1148959
636

Agnitum Outpost
PUA.GorillaPrice
7.1.1

Avira AntiVirus
ADWARE/GorillaPrice.330752
3.6.1.96

avast!
Win32:Dropper-gen [Drp]
2014.9-150421

AVG
Generic6
2016.0.3133

Baidu Antivirus
Adware.Win32.GorillaPrice
4.0.3.15421

Bitdefender
Application.Generic.1148959
1.0.20.645

Comodo Security
ApplicUnwnt
21831

ESET NOD32
Win32/Adware.GorillaPrice (variant)
9.11500

Fortinet FortiGate
Riskware/GorillaPrice
4/21/2015

F-Secure
Application.Generic.1148959
11.2015-09-05_7

G Data
Application.Generic.1148959
15.5.25

K7 AntiVirus
Adware
13.202.15641

McAfee
RDN/Generic PUP.x!c2z
5600.6789

MicroWorld eScan
Application.Generic.1148959
16.0.0.387

NANO AntiVirus
Riskware.Win32.GorillaPrice.dnowoj
0.30.10.952

Panda Antivirus
Trj/Genetic.gen
15.04.21.06

Reason Heuristics
Threat.Win.Reputation.IMP
15.5.9.13

Sophos
Generic PUA EL
4.98

Trend Micro House Call
TROJ_GEN.R002C0ECJ15
7.2.111

Trend Micro
TROJ_GEN.R002C0ECJ15
10.465.21

VIPRE Antivirus
Trojan.Win32.Generic
39508

ViRobot
Trojan.Win32.S.Agent.331264.AK[h]
2014.3.20.0

Zillya! Antivirus
Adware.GorillaPrice.Win32.74
2.0.0.2136

File size:
323.5 KB (331,264 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\windows discount\findingdiscount\findingdiscount.exe

File PE Metadata
Compilation timestamp:
12/28/2014 5:39:55 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

CTPH (ssdeep):
6144:X8EcRUXIAF5FnZA7+Vzs63DL5bZr5TdsUe7:X8EcGlF/nZW+VzDL5bZr55sT

Entry address:
0x2AE57

Entry point:
E8, 59, 9A, 00, 00, E9, A4, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, C8, AF, 44, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, CC, AF, 44, 00, 5D, C3, 05, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8, 1B, C0, 23, C1, 83, C0, 08, 5D, C3, E8, 6D, 26, 00, 00, 85, C0, 75, 06, B8, 30, B1, 44, 00, C3, 83, C0, 08, C3, E8, 5A, 26, 00, 00, 85, C0, 75, 06, B8, 34, B1, 44, 00, C3, 83, C0, 0C, C3, 8B, FF, 55, 8B, EC, 56, E8, E2, FF, FF, FF, 8B, 4D, 08...
 
[+]

Entropy:
6.5056

Code size:
235 KB (240,640 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:47574/

Local host port:
47574

Default credentials:
No


Remove findingdiscount.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.