game booster.exe

Game Booster

Bechiro S.L.

This is the Solimba installer program that will bundle additional offers mostly including adware and various unwanted PC utilities. The application game booster.exe, “Game Booster AppInstaller” by Bechiro S.L has been detected as adware by 2 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The file has been seen being downloaded from www.winportal.com and multiple other hosts. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.
Publisher:
Bechiro S.L.  (signed and verified)

Product:
Game Booster

Description:
Game Booster AppInstaller

Version:
3.0.17.4

MD5:
960210db8507b8a31c28eab76d843b44

SHA-1:
1283e5d624b10c7332baa6ac5669259819119e55

SHA-256:
d78e1b95d3aed16295701230752d228ec61de502a9328dffff39b15e865e5adf

Scanner detections:
2 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/27/2024 1:24:16 AM UTC  (today)

Scan engine
Detection
Engine version

Boost by Reason
Adware.Installer.BechiroSL.M
2013.7.26.22

Reason Heuristics
PUP.Installer.BechiroSL.M
14.8.8.2

File size:
198.2 KB (202,944 bytes)

Copyright:
AppInstaller 2013 (132062159)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\game booster.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/12/2012 5:00:00 PM

Valid to:
6/13/2014 4:59:59 PM

Subject:
CN=Bechiro S.L., OU=Devel, O=Bechiro S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
738DCAC697C06E1B89D106073773010D

File PE Metadata
Compilation timestamp:
2/19/2012 7:01:49 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

Entry address:
0x4327

Code size:
34.5 KB (35,328 bytes)

The file game booster.exe has been seen being distributed by the following 2 URLs.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to cdn.solimba.com  (95.211.6.35:80)

TCP (HTTP):
Connects to api.downloadmr.com  (95.211.39.161:80)

 
http://api.downloadmr.com/installer/11382/launch

Remove game booster.exe - Powered by Reason Core Security