gamingwonderland.exe

The application gamingwonderland.exe has been detected as a potentially unwanted program by 81 anti-malware scanners. This version of the file will bundle a Mindspark/MyWebSearch Toolbar, a potentially unwanted web browser extension.
Remove gamingwonderland.exe - Powered by Reason Core Security
MD5:
4d9eb3827e85db54dd3265b7df00c451

SHA-1:
5a3f02024727c108bbfa0a444fd32d15f0ea9660

SHA-256:
1dedd2f0f0fea25dc4fdd4a22dda630d050524a2d31ed261de01c28d273a6992

Scanner detections:
68 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
12/5/2016 1:40:03 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Runouce.B@mm
969

Agnitum Outpost
I-Worm.Chir.B
7.1.1

AhnLab V3 Security
PUP/Win32.FunWeb
14.06.10

Avira AntiVirus
W32/Chir.B
7.11.144.76

Antiy Labs AVL
Worm[Email]/Win32.Runouce.b
0.1.0.1

avast!
Mindspark-A [PUP]
140608-0

AVG
Adware Zango
2014.0.3955

Baidu Antivirus
Virus.Win32.Runouce.$a
4.0.3.14610

Bitdefender
Win32.Runouce.B@mm
1.0.20.805

Bkav FE
W32.ChirBPE
1.3.0.4959

Clam AntiVirus
WIN.Worm.Brontok
0.98/18355

Commtouch SDK
W32/Thecid.B@mm
5.4.1.7

Comodo Security
Virus.Win32.Virut.CE
18129

Dr.Web
9.0.1.05190

Emsisoft Anti-Malware
Win32.Runouce.B@mm
8.14.06.10.03

ESET NOD32
Win32/AdInstaller potentially unwanted application
7.0.302.0

Fortinet FortiGate
W32/Chir.B@mm
6/10/2014

F-Prot
W32/Thecid.B@mm
v6.4.7.1.166

F-Secure
Win32.Runouce.B@mm
11.2014-10-06_3

G Data
Win32.Runouce.B@mm
14.6.24

IKARUS anti.virus
Email-Worm.Win32.Runouce
t3scan.1.6.1.0

Jiangmin
Win32/cnPeace.b
KV140610

K7 AntiVirus
EmailWorm
13.176.11806

K7 Gateway Antivirus
EmailWorm
13.176.11806

Kaspersky
Email-Worm.Win32.Runouce
14.0.0.3732

Kingsoft AntiVirus
Win32.Type.b.6637
331020.49267

Malwarebytes
Virus.Chir
v2014.06.10.03

McAfee
W32/Chir.b@MM
5600.7103

McAfee Web Gateway
Heuristic.LooksLike.Win32.SuspiciousPE.J
7.7103

Microsoft Security Essentials
Virus:Win32/Chir.B@mm
1.10502

MicroWorld eScan
Win32.Runouce.B@mm
15.0.0.483

NANO AntiVirus
Virus.Win32.Runouce.bxafx
0.28.0.59288

Norman
Malware
11.20140610

nProtect
Win32.Runouce.B@mm
14.04.18.01

Panda Antivirus
W32/Chir.B
14.06.10.03

Quick Heal
W32.Runouce.B
6.14.12.00

Reason Heuristics
Threat.Win.Reputation.IMP
14.6.10.15

Rising Antivirus
PE:Worm.ChineseHacker-2!23772
23.00.65.14608

Sophos
W32/Chir-A
4.98

The Hacker
W32/Virtob.Gen(F)
6.8.0.6.161

Total Defense
Win32/Chir.B
37.0.10886

Trend Micro House Call
PE_Chir.B
7.2.161

Trend Micro
PE_Chir.B
10.465.10

Vba32 AntiVirus
Virus.Win32.Chur.A
3.12.26.0

VIPRE Antivirus
Win32.chir.b
28390

ViRobot
Win32.Chir.B
2011.4.7.4223

Remove gamingwonderland.exe - Powered by Reason Core Security
File size:
424.3 KB (434,512 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\gamingwonderland.exe

File PE Metadata
Compilation timestamp:
11/19/2013 3:58:43 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:yPlCs7FaXBGfsS3un8NjWRMT66GzI4SqSaJlEGYj4b8vTXl:yt/ZeBQLc8NCRMT67zIQSaHEGPb85

Entry address:
0x280C

Entry point:
E8, DE, 25, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 56, FF, 75, 0C, 8D, 4D, E8, E8, 40, FB, FF, FF, 8B, 5D, 08, BE, 00, 01, 00, 00, 3B, DE, 73, 54, 8B, 4D, E8, 83, B9, AC, 00, 00, 00, 01, 7E, 14, 8D, 45, E8, 50, 6A, 01, 53, E8, 51, 15, 00, 00, 8B, 4D, E8, 83, C4, 0C, EB, 0D, 8B, 81, C8, 00, 00, 00, 0F, B7, 04, 58, 83, E0, 01, 85, C0, 74, 0F, 8B, 81, CC, 00, 00, 00, 0F, B6, 04, 18, E9, A3, 00, 00, 00, 80, 7D, F4, 00, 74, 07, 8B, 45, F0, 83, 60, 70, FD, 8B, C3, E9, 9C, 00, 00, 00, 8B...
 
[+]

Entropy:
6.5900

Code size:
25.5 KB (26,112 bytes)

Remove gamingwonderland.exe - Powered by Reason Core Security