home

gerald_levert-written_all_over_your_face_-_levert,_gerald_downloader.exe

SimpleFiles Installer

New Monte Inc

The application gerald_levert-written_all_over_your_face_-_levert,_gerald_downloader.exe by New Monte Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 390, 1

MD5:
a929a0dc8121c158a42ed9e20bc7a909

SHA-1:
4cf5ab99daf70e9f7c50baab4a2942079d073f6c

SHA-256:
1ec9b4054e11868a10b0ae3bbfba7c32e1aa2775dc03ef4ed2a10001e900e037

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/28/2024 7:19:58 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Blisbury.NewMonte.Bundler (M)
16.6.30.9

File size:
3.7 MB (3,875,608 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\gerald_levert-written_all_over_your_face_-_levert,_gerald_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 6:00:00 PM

Valid to:
12/6/2016 6:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
11/24/2014 10:03:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:DKK+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYp:mmh3SQGPL+71l3CO4Yp

Entry address:
0x6F3BBA

Entry point:
E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1...
 
[+]

Entropy:
7.9285

Packer / compiler:
Xtreme-Protector v1.05

Code size:
968.5 KB (991,744 bytes)

The file gerald_levert-written_all_over_your_face_-_levert,_gerald_downloader.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GCUnDRpV8t KhJb8qlblnOvDNmpbdgV6ixZFW hCE1lYoiUPuvOkWxxnIBlJQVS66BQgCj0ixTlpwDXs51AAPdMUZ6xj9DcM00WTmNc oqwSy/azcsrSZlb/s0bVPMN2gYpERkW/.../YzBqj5MTO76DFchs1qF7LDPDa4yj0OtPU2Ht6eegGDwT8Qm4tTTcGLW7jdj16z2fNEut2zFdKXqwv5PvsfoDK25Kk44bD5Pu67xSDotJAgh6fKf9 gmSveqNMQyOnUGrHon0eRmdhB3MugR8OB9BFywqZfc9e5YGPc7HI7mqcmfKTkcyH872lu9YB1damcakGz2WofstpmG7yTVxm6xwVW2MBeAdXNDA2OYEIG22ERZIBmCTLJOE54zyI=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.