home

gta_real_brasil_vrfi.exe

SweepTools PC Cleaner

Secure Download

The application gta_real_brasil_vrfi.exe, “SweepTools PC Cleaner Setup ” by Secure Download has been detected as adware by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from cdn.nextadbulkranch.com and multiple other hosts.
Publisher:
Secure Download   (signed by Secure Download)

Product:
SweepTools PC Cleaner

Description:
SweepTools PC Cleaner Setup

MD5:
e2883f2c4dec9542b41d12aab1563791

SHA-1:
bbd2a4179bb0dd00d1761dbdd8d2765b27d0cccd

SHA-256:
bffd44d90222a217b3a3e8e684a9e077434fcab75aa43c3f8300ace9a2e3a24e

Scanner detections:
4 / 68

Status:
Adware

Analysis date:
5/27/2024 9:07:26 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Downware.694096
8.3.1.6

Dr.Web
Adware.Downware.11222
9.0.1.0164

Reason Heuristics
PUP.AVSoftware EOOD.Installer
15.6.13.2

Trend Micro House Call
Suspicious_GEN.F47V0606
7.2.164

File size:
18.2 MB (19,108,592 bytes)

Product version:
1.14

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\gta_real_brasil_vrfi.exe

Digital Signature
Signed by:
Secure Download

Authority:
Symantec Corporation

Valid from:
2/2/2015 10:00:00 PM

Valid to:
5/4/2017 8:59:59 PM

Subject:
CN=Secure Download, O=Secure Download, L=Varna, S=Varna, C=BG

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3D811659B9EF01A0EA3D317945C68F04

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:Y8O2qyBj4MbPJu3TG9YIe9o2g+1n2ZgK1scEU5:+yBjhrgjdIeK+1n2ZR/5

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file gta_real_brasil_vrfi.exe has been seen being distributed by the following 10 URLs.

http://cdn.nextadbulkranch.com/c?x=Uja7SeuymYni5rcAyxJyS102bGPPHHTeprx45PSlPzs=&c=HMqyo/GDjNQBR JZC3T6Ovpv4nphRkXiuseod7IJRF2945q34VDNB4t5 cEXeOOgfABurjOt8GHisyULTV9iHnpJMCANVPpPrVVqgdCtV4GTu/UnZvjCn7FVXFBy3TwM&fallback_url=http://.../setup.exe&downloadAs=serial_do_Office13__.exe

http://cdn.nextadbulkranch.com/c?x=bDRTM Azj6DqBT7lawK3hQgeyTHMFwv8Lgb/4ae5Z54=&c=pCOPb9ie12yR2i3 Vn6xkmOulcUL8uhFR5cJwYs2O1ziX7THLT4adDi79VTEEBtgXl5 imcHWyxq3VlkYr/q iobHOFTCw8OsmSqCpApgZndNOSQxNBaYMb cnU/ArDiF2ExW3jQYeRegYWs751F8g==&fallback_url=http://.../setup.exe&downloadAs=Anjos_de_Resgate_-_T.exe

http://cdn.nextadbulkranch.com/c?x=WzTWuBsJuTNJxr8GhZh9SLMVZKv3spx9Memtny26fBs=&c=jJKbwXEVk9nVm5G WWnaatx5vXgAL3dv GTsJ87X4lH4c/gaOcoR775DCi3J8TRNtFlTLkTF gQ4mWrShYoXR076RMNL3ia/HMfqF9P5j0gQV5yBEKCG4LuNfFR0GTYb&fallback_url=http://.../setup.exe&downloadAs=CATEDRAL_-_RENATO_RU.exe

http://cdn.nextadbulkranch.com/c?x=leO1I9eMZh9wF3Xcap8oMZX7pU9gqu21iDxdOpGIh2M=&c=FbqS9XcbLNrUYzz9eH2RCB4o73c7c8FrKkA12EJyO5GMd3Q25I 9fMC/uUIn1PtcArao7uG1Q50J6x0CFyBc77AwBVnhQVR3y0jFaQ6Ph/oH/Zi9oVmZFORbh3H09J7P&fallback_url=http://.../setup.exe&downloadAs=y236k_jellybread_v2_.exe

http://cdn.nextadbulkranch.com/d?did=XzybJU6NQOaZdcnedGMc_R5s48z97ADDEfTzKpIdbwMRJ50AvnDwCrxafcfU89cbV_Q&downloadAs=setup.exe&fallback_url=http://.../setup.exe

http://cdn.nextadbulkranch.com/c?x=Hj 8cTD60oDxTEbU6F8p3s0ZASnjJCkJJmiIF5 qJKM=&c=LPJjeZGjK5bcnxghQjZl4Qwa0QaEpE W Q7FCDf/6/cdH9AndLtBmqr3IvyMUdnO 6QCRy06bjYHVzFftRs/TRFpCmPIAUqRoxrcPLP GlvXtzmK0OKRstnHYu1jUWz &fallback_url=http://.../setup.exe&downloadAs=Placa_de_Video_Virtu.exe

http://cdn.nextadbulkranch.com/c?x=232qy5IUvmIqr/kX16nzlYLPXhbEXql9Y0V6kMDMAHQ=&c=zZ5OQ8bz9p5a/kOw4Ba98vl 0TNiyVsdrsEFpsCMoh9h84VvzQ1AV hLtZ oChonUToi6GFY6TetYl5TJD7YpOqYeqMNVrJZljHxCIhhB8Mb1R48YovMpP3 8/5e2R9A&fallback_url=http://.../setup.exe&downloadAs=layout_fim_de_tarde_.exe

http://cdn.nextadbulkranch.com/c?x=uXBYizSc5QPAgauwd72SRzDeK8CuIfbN3KXI56WGw7U=&c=Kjl6QsS6 3fRJnkK/ 9XiNY9ETTowbCJNw2pSmK2h/x4/8kR7Wkd pFg8Dwvmq6cCgjSmiiZk7mghk3E3HmPiwVxtiStC7kuGpfqgullYO949ZCKxb8LjmshR 3NlWNa&fallback_url=http://.../setup.exe&downloadAs=_______-___________.exe

http://cdn.nextadbulkranch.com/c?x=pHg/uIV16DSin0Ut9X88OpKz5G70ziXLDhAMQnOLw/8=&c=X6i2S6TotS3pbLV4FWdagEB9xGQftq7a0zRVqMxV6ojH/kbIIFHy5fraq qFDZffuYss4oscSynJhu ibj9h/XaXFzNrQiJofg/jABXpCa54wPQy2frSEHY/j6XMaWO3&fallback_url=http://.../setup.exe&downloadAs=_______-____________.exe

http://cdn.nextadbulkranch.com/c?x=E2YUye3hY7L2DHn/nijRR6ZRKwhluC0o O4 VXiNIsE=&c=EK861cNmtvnZQjw7OgZRI/e6dTS132DRorOlg0HLKaNvmzW0TUalCR9IHqTJtJe68gsPuAqyDCD7GU8d18MZSXuRTIhSycJ12b2MRW90Xsh40jLt8WfoT5eAKyZfSumd&fallback_url=http://.../setup.exe&downloadAs=Card_Recovery_v610_b.exe

Remove gta_real_brasil_vrfi.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.