» junjou_romantica_font_downloader.exe
Overview
Analysis
File Details

junjou_romantica_font_downloader.exe

Spring Installer

Via Advertising Group Ltd.

The application junjou_romantica_font_downloader.exe by Via Advertising Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software.

File name:

Publisher:

Factory Choco LLC (signed by Via Advertising Group Ltd.)

Product:

Spring Installer

Description:

Spring Files

Version:

1, 0, 1005, 1

MD5:

8d8837381842554cc7c7a55ce9a84b17

SHA-1:

b1a0ad51d2558507ff9155c3147c1770485e5451

SHA-256:

b94536c5d052c9059ecaed217db8799f1e57f811c11f00bb34cf9d3da431b9ff

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

4/26/2024 11:06:15 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Via Advertising.ViaAdvertisingGroup.Installer (M)

15.10.6.13

File size:

4.5 MB (4,739,280 bytes)

Product version:

2.0.0.1

Original file name:

springfiles.exe

File type:

Executable application (Win32 EXE)

Language:

English

Common path:

C:\users\{user}\downloads\junjou_romantica_font_downloader.exe

Digital Signature

Signed by:

Via Advertising Group Ltd.

Authority:

COMODO CA Limited

Valid from:

2/27/2015 12:00:00 AM

Valid to:

2/26/2017 11:59:59 PM

Subject:

CN=Via Advertising Group Ltd., O=Via Advertising Group Ltd., STREET=Boumpoulinas 11, L=Nicosia, S=n/a, PostalCode=1060, C=CY

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

008B2BB84E7F31907B6B96E71DB3365B38

File PE Metadata

Compilation timestamp:

9/18/2015 1:40:03 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

14.0

CTPH (ssdeep):

98304:b6KpOeMDlioLpNz8BZhfecES+NNgHgkps6/FIwTCsm/1V:MDD/z8BPfWIgGs22sm/1V

Entry address:

0x97A673

Entry point:

68, F2, B5, 31, C5, E8, 3A, 95, BD, FF, D8, 5A, 0A, AF, 82, 9B, A7, F9, 4E, 1F, F7, 63, 79, 6C, 4F, 00, 00, 4C, 6F, 61, 64, 4C, 69, 62, 72, 61, 72, 79, 41, 00, CA, 51, 13, 9D, 86, BF, A7, F2, 5E, 04, E8, 55, 75, 41, 2A, 92, 8C, EC, 7E, 83, E8, 99, 55, BF, 7C, A5, C2, 67, B9, 7C, B7, A8, 17, 8C, 7C, BC, 9C, 91, 4C, 83, EB, 3E, 3E, B0, 7C, 40, 8B, E2, BE, 7C, A1, 4B, BC, B3, 7C, F4, 30, F9, 77, 83, 91, 38, BE, BA, 7C, 98, 50, E2, 88, 7C, 51, FD, 95, 48, 83, F5, 15, 7E, B4, 7C, 9C, 8B, 60, EA, EE, 9B, 45, 83... 
[+]

Entropy:

7.9921 (probably packed)

Code size:

4.4 MB (4,644,864 bytes)

Remove junjou_romantica_font_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.