FTDownloader.exe

FTDownloader

VASSANA KONGSOONGNERN

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application FTDownloader.exe by VASSANA KONGSOONGNERN has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities.
Publisher:
Cool Mirage  (signed by VASSANA KONGSOONGNERN)

Product:
FTDownloader

Version:
1.1.4.0

MD5:
ffb70d6949fdd663086fce9e2afb3a58

SHA-1:
86ed0f815938e51a4ef53084a4d28972f9c42e7f

SHA-256:
ecd9794e81d087f2b0cc1e5478d0ba15a44653b6e1ac9d0994baab35e0a14fea

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
4/25/2024 8:02:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.CoolMirage.VASSANAK (M)
16.5.4.6

File size:
2.5 MB (2,672,384 bytes)

Product version:
1.1.4.0

Copyright:
Copyright © Cool Mirage 2013

Original file name:
FTDownloader.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\ftdownloader.com\ftdownloader.exe

Digital Signature
Authority:
Thawte, Inc.

Valid from:
10/5/2014 7:30:00 PM

Valid to:
10/6/2015 7:29:59 PM

Subject:
CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata
Compilation timestamp:
7/15/2013 10:32:03 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:ZE46iueAhCCCGMzAtww2NlRp3j2JVpK761Y8EedltzV3P9J+bf+ukUIbsHvrr//N:ZE4VueAhCCC9Etww2yJTp1HltxeZkziN

Entry address:
0x2888EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9340

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.5 MB (2,648,576 bytes)

The file FTDownloader.exe has been seen being distributed by the following URL.

Remove FTDownloader.exe - Powered by Reason Core Security