home

krug_tarnen_tricksen_taeuschen.pdf_downloader.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application krug_tarnen_tricksen_taeuschen.pdf_downloader.exe by Righway Technologies, Inc has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. Additionally, the file is typically installed by a number of programs including GameCenter by Noverix Enterprise LTD. and GoforFiles by Righway Technologies, Inc. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 19

MD5:
fc71a09d22899607a46041e21712bc28

SHA-1:
6e7587f0e6f70b49c34761ee585dff57a98a5c91

SHA-256:
385c6e7c586d68d19f2d4f205c52dd1cf351e3c750793ad76f0de5a802e0026f

Scanner detections:
5 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 7:38:47 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-140520

ESET NOD32
Win32/YourFileDownloader (variant)
8.9387

Malwarebytes
PUP.Optional.GoForFiles.A
v2014.05.20.12

Reason Heuristics
PUP.RighwayTechnologies.m
14.8.7.21

VIPRE Antivirus
ExpressFiles Installer
26180

File size:
4.4 MB (4,604,560 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\krug_tarnen_tricksen_taeuschen.pdf_downloader.exe

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
10/10/2012 8:03:47 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:eUeTxb8Yn3nkIW5JHWPXZIUfHqQUReYNa1pVsDpAuieY6D:uBfn3nk/2PvfTU3Na1HsDpAz4

Entry address:
0xB315

Entry point:
E8, DC, 55, 00, 00, E9, 89, FE, FF, FF, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, E0, A9, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 07, 49, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 90, B4, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, A4...
 
[+]

Code size:
97 KB (99,328 bytes)

The file krug_tarnen_tricksen_taeuschen.pdf_downloader.exe has been discovered within the following programs.

GameCenter  by Noverix Enterprise LTD.
Publisher's description - “Joyvy is a handy online playing service. Imagine all your favorite games from online resources and social networks are in one place. That is Joyvy does. Nothing but gaming.”
joyvy.com
About 1% of users remove it
GoforFiles  by Righway Technologies, Inc
GoforFiles bundles various adware toolbars including the Delta Search Toolbar (an adware toolbar that modifies the user's web browser home page, search settings and other settings).
www.goforfiles.com
70% remove it
 
Powered by Should I Remove It?

The file krug_tarnen_tricksen_taeuschen.pdf_downloader.exe has been seen being distributed by the following 9 URLs.

http://go.goforfiles.com/.../c 8KHW7lTpwpc4nRrbPL1Xp3Gwf6cRVHuTMXhSXlAJS2c9fD85yBlybaB4mzTs=

http://go.goforfiles.com/j5GmWGzEu1ot0aEUfNG0LXrT/iN3rPIlebapKjG4hTU1qIAkQbGbPEemxjhYuYUKXfqBFA/.../wjlOYId4HT2VeOdz2mG6NA==

http://go.goforfiles.com/j5GVUnDdrFVi1apNY5OfLCWN4mxGobE eO/vfyr/.../vTpEv5QPQbCUBlzLuwpEhZMIEaVoH1eHLjMjlXsaLt99GyzeZfBzzSayYjAvs2M9LKktZUj3Yz4VokRjXPkReUT7Vz5Fngg=

http://go.goforfiles.com/j5G2VmzEoFdq1aNeIcqwKnSXtjJzpKsqcqX2P36uxydt8dRkF DabhPk32kMr5wKSuHHVwfGih5Uk5AGXtUnBwOK

http://go.goforfiles.com/j5GHdlH1mhBE/YJzRf YAE/.../gNX65UKPYeSAV6dogdf56x8UrSPfVKn0G4Z7cBbHeXGUwPGjgZfgMBdCt0nAEuOchorlDRK

http://go.goforfiles.com/j5G8WHeVjAkjjP0aM4GjJiXIvSI5r7cuPbC1Lm7jiHh6o4tyZ LMYxbx1GZe84YCQKjeAUCFnEBSi4oBVodgFxiYdkpzwzxLc8M/TnnMN/.../g3YUWueHgY8Q==

http://go.goforfiles.com/.../9BnG bcahPmyyhHsZVeHOzAQUGVmxxbjZlSHJw8FQ==

http://go.goforfiles.com/.../wQ==

http://go.goforfiles.com/.../nUi8OttYrfgfin90Goo NFgEfaeNk w0G0a7dcQW76CCluExFk=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.