home

p t v sports live.exe

Andrey Hmelnikov

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application p t v sports live.exe by Andrey Hmelnikov has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from profficers.info.
Publisher:
Andrey Hmelnikov  (signed and verified)

MD5:
dabe7a331c1e5b86db3f1562bbda855b

SHA-1:
78d723a1af293549dfb3d3b457fa707fa9187323

SHA-256:
7b7f1c61243849af19c0bd01fb3d9eab9903ec62bf5e61974cc89e5653c28529

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/9/2024 11:02:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebPick (M)
16.8.3.12

File size:
1.1 MB (1,111,928 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\p t v sports live.exe

Digital Signature
Signed by:
Andrey Hmelnikov

Authority:
Unizeto Technologies S.A.

Valid from:
6/23/2014 10:25:04 AM

Valid to:
6/23/2015 10:25:04 AM

Subject:
E=Andrey.Hmelnikov@hotmail.com, CN=Andrey Hmelnikov, O=Andrey Hmelnikov, C=RU

Issuer:
CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
727B500ADD12D49F610A094EBFE02E4B

File PE Metadata
Compilation timestamp:
2/12/2013 11:35:32 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:LLeb4BcOe98C3Vuz1hPK9ftuROpNpBqyO2NHI:Q4Bxe9zFuzLcfwMbK2C

Entry address:
0xB2E39

Entry point:
E8, FE, 13, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C0, 92, 4F, 00, E8, 11, 19, 00, 00, E8, CB, 15, 00, 00, 0F, B7, F0, 6A, 02, E8, 91, 13, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 40, 03, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.4277

Code size:
736 KB (753,664 bytes)

The file p t v sports live.exe has been seen being distributed by the following URL.

http://profficers.info/hp/?q=dHS BOOwg6BVo9/XZTKVg6wnqZN8DiF60mlnqYqKoPjEpCgiR2aQFlF6jah ynJ5MqOsoSsmspofbqtisYrcd3T1Icbn7AS8951CT6eJAsRQxMPAROlWAnJSRMs8zSubeHFPkLKV8or60orKiw mT6AkBb0SiRZsda1Woe5f2SyC9X93G4Fu41aFyQRIT7/wIZ40Z dp7alEWVrm8FJig12rQFQ/hoXGV7wr8CftE/vI4iYvtYXm7OtDhyJrT7FxigA4AMFN5GMosQm0tRlCtmZsOyX7MO231cAcObVHJGrqUqp1oGYKeM HS6JgESaeKnHix0kqgwoK3TK8iyXoCGdRgrOToZLeJU2uCy27DsyZ0F6FlTV2A3kE0OZZC41XBkiyzmKdtTfxWuQTRk6leDCHoNUk/8T9yPOcM8jrX7zcn qPWZOW mJUsYmEouUWFRcaTirhnXT1aGIb8wjVg1/g74N9zolzuC3Ji0gZBdqIJxM T9ElhfC/Edr8KrDQ0Oh0jFoGv6iMPJcKaMzSSvNdelU6cYmtPOgjw9 ELxp17YpgHYR9EdTaSuJ32m2 RKtqKpvVZ7JHJbcPp7IfTi/L48/HCswXfYePWY/Qu0oaf0loSRLhghHRQgXkc/tTe8Zf1t6g5C9gNuOiyugZu/WEwJwv96ifODFA5o3Pw17RzgZZ8yfvyrQ37keOvcgirukRVoLbCH2cgKyLesXgHjE7lS3/0rrL2w9BzQlYtDo4qLzUWfq8X2u mFp7yQR1y13dmEu a/mfeJBw8nSuAfzr9Ue2kXI2XmdUWYDG0GqFpyrJJE/NlQ0U8eDglJEgFE51jZb2VzrnZhu f9IYaZVX8cz55IGh9cr34abxbB6X0ElGfJ3OgE18WZNosHUJxIz 5augmdkOJ mSnJlBZvPFN2H0B9li/.../qf5jf

Remove p t v sports live.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.