home

gravity3_setup.exe

RoeiBajayo

The executable gravity3_setup.exe, “Gravity 3 Installation ” has been detected as malware by 10 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. This trojon will perform a number of actions that will compromise a PC including changing protected system registry values, hiding in protected operating system locations and downloading and installing additional malware.
Publisher:
RoeiBajayo

Description:
Gravity 3 Installation

Version:
3

MD5:
adec2e7b4d2f68c76252709143bcd767

SHA-1:
094271ffa409eb8a443a3bef0f5b1f6128b50ec1

SHA-256:
3edda8a85b790af9cb0bef9bbbfbf6692c293a6135f5565fa4b3631ece3fef08

Scanner detections:
10 / 68

Status:
Malware

Analysis date:
5/12/2024 4:02:06 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Delf.aqpl.1
7.11.115.128

Baidu Antivirus
Trojan.Win32.Rettesser
4.0.3.15220

Bkav FE
W32.Clodd99.Trojan
1.3.0.4562

Fortinet FortiGate
W32/Rettesser.IE!tr
2/20/2015

IKARUS anti.virus
Trojan-Dropper.Delf
t3scan.2.2.29

Kaspersky
Trojan.Win32.Rettesser
14.0.0.2458

McAfee
Artemis!ADEC2E7B4D2F
5600.6849

Microsoft Security Essentials
Trojan:Win32/Malagent
1.163.1557.0

Norman
Suspicious_Gen2.NWKXP
11.20150220

Vba32 AntiVirus
Trojan.Rettesser
3.12.24.3

File size:
1.6 MB (1,703,984 bytes)

Copyright:
RoeiBajayo

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\gravity3_setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:OdYRYqG4S0i8hEIkQd0UgjYWCIvBXbaQ1:OdYRU4JhEI7RWB5Xx

Entry address:
0x17DE0

Entry point:
55, 8B, EC, 83, C4, F0, B8, 18, 7D, 41, 00, E8, F0, AA, FE, FF, B8, 40, 7E, 41, 00, E8, F6, 17, FF, FF, 8B, 15, AC, 86, 41, 00, 89, 02, 8B, 15, AC, 86, 41, 00, 8B, 12, A1, B0, 86, 41, 00, E8, 80, D5, FF, FF, 8B, 15, AC, 86, 41, 00, 8B, 12, A1, 50, 86, 41, 00, E8, 3A, 71, FF, FF, A1, AC, 86, 41, 00, E8, E8, 09, FF, FF, E8, 0B, 9B, FE, FF, 00, 00, 00, FF, FF, FF, FF, 01, 00, 00, 00, 2A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9761

Developed / compiled with:
Microsoft Visual C++

Code size:
92 KB (94,208 bytes)

The file gravity3_setup.exe has been seen being distributed by the following URL.

http://www.mygravity.net/.../Gravity3_Setup.exe

Remove gravity3_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.