» gta iv.exe
Overview
Analysis
File Details
Downloads (1)

gta iv.exe

PortalProgramas

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application gta iv.exe by PortalProgramas has been detected as adware by 28 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.softohqimjjedf0jq.net.

File name:

gta iv.exe

Publisher:

Rapiddown (signed by PortalProgramas)

Description:

DownloaddMger

Version:

1.0.0.27

MD5:

fc9d5dc2c368c3032239a716ed776850

SHA-1:

12613d57d45981f8858a12d58edf6a2a9c458a1f

SHA-256:

8c5a3707e30a0ec731e250d2e9d40694f4653003f20f65a8bbfc35a6a5cccb2c

Scanner detections:

28 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/27/2024 2:42:54 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Bundler.Firseria.1

835

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.FirseriaInstaller

2014.10.23

Avira AntiVirus

TR/Crypt.ULPM.Gen

7.11.30.172

avast!

PUP-gen [PUP]

141003-0

AVG

Adware BundleApp.R

2014.0.4040

Bitdefender

Gen:Application.Bundler.Firseria.1

1.0.20.1475

Comodo Security

Application.Win32.Bechiro.BDC

19875

Dr.Web

Trojan.DownLoader11.3153

9.0.1.05190

Emsisoft Anti-Malware

Gen:Application.Bundler.Firseria

14.10.22

ESET NOD32

Win32/FirseriaInstaller.C potentially unwanted application

7.0.302.0

Fortinet FortiGate

Adware/Sality.MO

10/22/2014

F-Prot

W32/Firseria.C

4.6.5.141

F-Secure

Gen:Application.Bundler.Firseria

11.2014-22-10_4

G Data

Gen:Application.Bundler.Firseria

14.10.24

IKARUS anti.virus

not-a-virus:Downloader.Win32.Morstar

t3scan.1.7.8.0

K7 AntiVirus

Unwanted-Program

13.184.13741

Kaspersky

not-a-virus:Downloader.Win32.Morstar

15.0.0.494

Malwarebytes

PUP.Optional.Firseria

v2014.10.22.09

MicroWorld eScan

Gen:Application.Bundler.Firseria.1

15.0.0.885

NANO AntiVirus

Trojan.Win32.Morstar.csnpwt

0.28.2.62841

Quick Heal

Trojandownloader.Morstar.O5

10.14.14.00

Reason Heuristics

PUP.PortalProgramas.G

14.10.22.20

Rising Antivirus

PE:PUF.FirseriaInstaller@CV!1.9C54

23.00.65.141020

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.3

VIPRE Antivirus

Threat.4782980

33706

Zillya! Antivirus

Downloader.Morstar.Win32.11

2.0.0.1964

File size:

171 KB (175,088 bytes)

Product version:

3.0.26

Original file name:

¡nstal·exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Common path:

C:\users\{user}\downloads\gta iv.exe

Digital Signature

Signed by:

PortalProgramas

Authority:

COMODO CA Limited

Valid from:

1/1/2013 6:00:00 PM

Valid to:

1/2/2014 5:59:59 PM

Subject:

CN=PortalProgramas, OU=Tech, O=PortalProgramas, STREET="Balmes 1, primera planta", L=Terrassa, S=Barcelona, PostalCode=08225, C=ES

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D970D9AAEE52971159EE95FA00AF652F

File PE Metadata

Compilation timestamp:

12/20/2013 5:22:50 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:VXhaoP7Ddc4kJ5sXegDChJo8p8+EOjBPD3hSEE9TCcGZflRJueUhVQqWKBGoutbK:of5gtCh2dLOjBT8E2fG1l3jcwKMoSJY

Entry address:

0x62F90

Entry point:

60, BE, 00, F0, 43, 00, 8D, BE, 00, 20, FC, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 1A, 03, 06, 00, 57, 83, C3, 04, 53, 68, 86, 3F, 02, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A... 
[+]

Entropy:

7.8856 (probably packed)

Code size:

148 KB (151,552 bytes)

The file gta iv.exe has been seen being distributed by the following URL.

http://dl.softohqimjjedf0jq.net/n/3.0.26.1/.../GTA IV.exe

Remove gta iv.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.