gimp.exe

Useful Software

This is the Verti bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application gimp.exe by Useful Software has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the Verti Setup installer. The file has been seen being downloaded from inst.greatappsfree.net and multiple other hosts.
Publisher:
Useful Software  (signed and verified)

Version:
1.0.0.3

MD5:
9393a63b947f4786b843346a2bb06602

SHA-1:
e1efacd3464c0df3e8233d09ada2a1ef2bdb66fa

SHA-256:
361f2ff186982856a88a72b0353a5a865f66436ee3592a310cb53382a94177c5

Scanner detections:
6 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 3:24:57 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Usefus
2015.0.3467

ESET NOD32
Win32/Verti (variant)
8.9830

G Data
Win32.Trojan.Agent.FPR06Z
14.5.24

McAfee
Artemis!9393A63B947F
5600.7123

Trend Micro House Call
TROJ_GEN.F47V0516
7.2.141

VIPRE Antivirus
Rocketfuel Installer
29454

File size:
365.9 KB (374,728 bytes)

Product version:
1.0.0.3

File type:
Executable application (Win64 EXE)

Bundler/Installer:
Verti Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\gimp.exe

Digital Signature
Signed by:

Subject:
CN=Useful Software, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Useful Software, L=Bellevue, S=Washington, C=US

Serial number:
7DB9B4E338BDCF4F909F675C098B0E76

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
6144:CKk02wQjZnnUAHlESM9Pt/IBP4BoHg8dqqkSyorKvEAO9ALqE1cxfro7zF1W+LVy:CL02dncz9F/IBABoHVLv7bALqE1cxfrx

Entry point:
E8, 46, A7, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A1, 90, 10, 45, 00, 33, C5, 89, 45, FC, 83, 7D, 08, FF, 57, 74, 09, FF, 75, 08, E8, D1, 85, 00, 00, 59, 83, A5, E0, FC, FF, FF, 00, 6A, 4C, 8D, 85, E4, FC, FF, FF, 6A, 00, 50, E8, 93, B3, FF, FF, 8D, 85, E0, FC, FF, FF, 89, 85, D8, FC, FF, FF, 8D, 85, 30, FD, FF, FF, 83, C4, 0C, 89, 85, DC, FC, FF, FF, 89, 85, E0, FD, FF, FF, 89, 8D, DC, FD, FF, FF, 89, 95, D8, FD, FF, FF, 89, 9D, D4, FD, FF, FF, 89, B5, D0, FD, FF, FF, 89, BD, CC...
 
[+]

The file gimp.exe has been seen being distributed by the following 7 URLs.

Remove gimp.exe - Powered by Reason Core Security