home

minecraft.exe

Liniad Media LTD

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application minecraft.exe by Liniad Media has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Liniad Media LTD  (signed and verified)

MD5:
289789e6969da6e6a9d2a2d8890d2a0e

SHA-1:
a1e6587e730dce7faca9111cf09a0213104eb0e2

SHA-256:
990be574bd74173d721739da55cfa4ecd0640c170c5f8a7a9a3b92c6b6c5143f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/7/2024 10:54:54 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.7.29.8

File size:
758.3 KB (776,528 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft.exe

Digital Signature
Signed by:
Liniad Media LTD

Authority:
COMODO CA Limited

Valid from:
3/18/2014 8:00:00 PM

Valid to:
3/19/2015 7:59:59 PM

Subject:
CN=Liniad Media LTD, O=Liniad Media LTD, STREET=19 Hatzfira Street, L=Tel Aviv, S=Israel, PostalCode=67779, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
5DE2969F7CEB3993FDFAC132AAED693E

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:qfvplspD63WvYGVTAQa+kzOXfr4j7t5+iyy4BlqnVYdV0eWftksvrB7AbnV9wl1:qfvTsIYYG9LaaonQBlkpeYtkcrB7Ujw/

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8520

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file minecraft.exe has been seen being distributed by the following URL.

http://cdn.captaindownloadfiles.com/?data=CG4Gf7A 6QTIPB6e6xO06a8r2eWo6DvoaN5Caa9Fh6I9Li/lprg7yBfz0pzter5FZGctkkwEHfADZsnTjfLMKYJAla9oye4w/t/BpVx GXRZQVNxfAMg0RzoWPuxhbxG0K/JVzFgnxsTjAi58McsDwQw18/L/2RiS4FnGZjtD8cbY/bpVuOIfEOuu9tfF2WLDd He0zEddPo7WiU4h1A08T5G6nXOaFn1mrLc zbXCILCkuWgUqdO4EDYVWuHFSwc5BGioqOpO75xF0qw LkHdNGSwHCdCh052ogNjcb5MFcVZ0aFGYPUZHyz0Rt3H9fAArpgQ/CwKrF3OZ2cBRxaqcckCaG0kEusbKpehD/dE2HhBc /PVrIKB5GWQ0Dqc/MShNdFpZMyRysKDW0mk46S MPwPgkmO/JCwdPR3lbwT/8Uazrr09ySVHpORnnd3Dl0IQteyIRQgc8usU9w3rEMyI7sUoKKMpJbOLsnXA/qweKFSXas4ucDxgXXgn/oN2Mz8F4zwhYNASO1tzVJ41rSX2QocedIx lExZ/05MQHXxIo1CSZid9pUqeKyG6MS 6vygh7o QGTEwPDcJa46VDD2PBqyJCfepbW6moh8ZO6hc7fpDXWn9MzgSzvsb DXrzLtozEOjBxo77uFUnCVNPq/zkS/whj/tMKvDmcGbLclLHieWyzxMzCVMv8PL/Umk wY6b24xGoej1QrYv7iUR7cdtsnvS0c1oJdNZJUe5WTFkWoWYN7cJTcs7my4ms60SonhHrtkITHSxUTgBe47ynuOQvwyDBSO/.../TJ7xVSOYGgoALB6gchkxvYHeP8Sii3L3oAQEjj5COwMyyd3UoBRva0 lfApQ tQGfA8cXgBc6ZgcOqd

Remove minecraft.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.