home

minecraft_alpha_1.1.exe

Downloadnow Ltd

The application minecraft_alpha_1.1.exe by Downloadnow has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the OneClickDownload Installer installer. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware. The file has been seen being downloaded from www1clickdownloader.com.
Publisher:
Downloadnow Ltd  (signed and verified)

MD5:
c6986bb77386486b8ca1eaae34014459

SHA-1:
948bd56c04475e92c086e1f6e03affddb0ba06bb

SHA-256:
b4501ebd5a622d5b089bba0eda7ea1d5f0341ab83ed86fa48be3555778cfbc88

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 9:33:24 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OneClickDownload.Bundler (M)
16.6.21.11

File size:
223.7 KB (229,096 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OneClickDownload Installer (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\minecraft_alpha_1.1.exe

Digital Signature
Signed by:
Downloadnow Ltd

Authority:
Thawte, Inc.

Valid from:
4/12/2012 4:00:00 PM

Valid to:
4/13/2013 3:59:59 PM

Subject:
CN=Downloadnow Ltd, O=Downloadnow Ltd, L=Limassol, S=Limassol County, C=CY

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
16B7670FC14AA2B216D5329335628558

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:AQqA1BA+RjtXV1pcJGUg1ZoNYP/fdjP/W:b16+Rpdc8UgzBP3djPO

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.8394

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file minecraft_alpha_1.1.exe has been seen being distributed by the following URL.

http://www1clickdownloader.com/download/product_download.php?fileName=http://1337x.org/download/.../&name=Minecraft Alpha 1.1.2 01 Offline Only - Hybrid(Windows, Mac OS, Linux)

Remove minecraft_alpha_1.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.