» games desktop.exe
Overview
Analysis
File Details

games desktop.exe

TUTO4PC COM INTERNATIONAL SL

This is the Eorezo installer which may include software offers for unwanted programs including toolbars. The application games desktop.exe by TUTO4PC COM INTERNATIONAL SL has been detected as adware by 19 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. It is also typically executed from the user's temporary directory.

File name:

games desktop.exe

Publisher:

TUTO4PC COM INTERNATIONAL SL (signed and verified)

MD5:

4d0a32543fb3bd702a8e82e4544142d0

SHA-1:

419e017e8dadc6912f02fcd129372dd0750e612e

SHA-256:

7f97072b94931d4bf1f026f974dbca4b1ca81660a9b7c92ad31935f63fb251ab

Scanner detections:

19 / 68

Status:

Adware

Analysis date:

4/19/2024 1:05:23 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Eorezo.CD

6505244

AhnLab V3 Security

Win-PUP/EoRezo

2015.02.02

Avira AntiVirus

Adware/EoRezo.bonc

7.11.206.68

AVG

Generic6

2016.0.3212

Baidu Antivirus

Adware.Win32.EoRezo

4.0.3.1521

Bitdefender

Adware.Eorezo.CD

1.0.20.160

Dr.Web

Threat.Undefined

9.0.1.05190

Emsisoft Anti-Malware

Adware.Eorezo.CD

9.0.0.4799

ESET NOD32

multiple threats

7.0.302.0

F-Secure

Adware.Eorezo.CD

5.13.68

G Data

Adware.Eorezo.CD

15.2.25

K7 AntiVirus

Adware

13.193.14824

Kaspersky

not-a-virus:AdWare.Win32.Eorezo

15.0.0.543

Malwarebytes

PUP.Optional.Tuto4PC.A

v2015.02.01.05

MicroWorld eScan

Adware.Eorezo.CD

16.0.0.96

nProtect

Adware.Eorezo.CD

15.01.30.01

Reason Heuristics

PUP.Eorezo

15.2.1.5

Sophos

PUA 'TUTO4PC'

5.10

VIPRE Antivirus

Threat.4895339

36694

File size:

3.2 MB (3,378,080 bytes)

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\games desktop.exe

Digital Signature

Signed by:

TUTO4PC COM INTERNATIONAL SL

Authority:

GlobalSign nv-sa

Valid from:

6/3/2014 9:55:26 AM

Valid to:

7/28/2015 1:19:10 PM

Subject:

E=contact@tutoriales100.com, CN=TUTO4PC COM INTERNATIONAL SL, O=TUTO4PC COM INTERNATIONAL SL, L=BARCELONA, C=ES

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C8382D4ADA7C0F9495915A4D5B4D8C97

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:H61Ff6gEnjTzO3/4hQlv13YTlpbjQ0nq+aOUxj:arf6JnjT12xNYppf1nPPUx

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9981

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

Remove games desktop.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.