» p3d-tt.exe
Overview
Analysis
File Details
Downloads (8)

p3d-tt.exe

The application p3d-tt.exe has been detected as a potentially unwanted program by 37 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from docs.google.com and multiple other hosts.

File name:

p3d-tt.exe

MD5:

8eb97877fc2fc323a6f7c0c2955571cb

SHA-1:

90156d48dae744fb62c6d946d198b30518716aee

SHA-256:

9bf5bb6095c4ca25c0d3c775725711caebc1fd3ea2fba13a0057a47ee9552d8f

Scanner detections:

37 / 68

Status:

Potentially unwanted

Analysis date:

4/26/2024 5:38:04 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.Agent.B

857

Agnitum Outpost

PUA.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.IBryte

14.10.01

Avira AntiVirus

ADWARE/Adware.Gen7

7.11.147.26

avast!

Adware-gen [Adw]

2014.9-141001

AVG

Adware AdPlugin

2015.0.3335

Baidu Antivirus

Trojan.Win32.Clikug

4.0.3.14101

Bitdefender

Application.Bundler.Agent.B

1.0.20.1370

Clam AntiVirus

Win.Adware.Ibryte-592

0.98/19086

Comodo Security

Application.Win32.iBryte.WRP

18251

Dr.Web

Adware.iBryte.473

9.0.1.0274

Emsisoft Anti-Malware

Gen:Variant.Adware.Graftor.145314

8.14.10.01.01

ESET NOD32

Win32/AdWare.iBryte.AR application

8.7.0.302.0

Fortinet FortiGate

W32/Zbot.AAN!tr

10/1/2014

F-Prot

W32/A-c255719d

v6.4.7.1.166

F-Secure

Application.Bundler.Agent

11.2014-01-10_4

G Data

Win32.Adware.Ibryte

14.10.24

IKARUS anti.virus

AdWare.iBryte

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.177.12013

Kaspersky

not-a-virus:Downloader.NSIS.Agent

14.0.0.3170

Malwarebytes

PUP.Optional.OptimumInstaller.A

v2014.10.01.01

McAfee

Trojan.Artemis!2BDA97A3EE62

5600.6991

Microsoft Security Essentials

TrojanClicker:Win32/Clikug.A

1.10401

MicroWorld eScan

Application.Bundler.Agent.B

15.0.0.822

NANO AntiVirus

Trojan.Win32.Agent.cxjjsz

0.28.0.59608

nProtect

Adware.IBryte.Y

14.08.13.01

Panda Antivirus

Trj/Genetic.gen

14.10.01.01

Qihoo 360 Security

Malware.QVM10.Gen

1.0.0.1015

Reason Heuristics

Threat.Win.Reputation.IMP

14.10.1.1

Rising Antivirus

PE:Malware.iBryte!6.192B

23.00.65.14929

Sophos

iBryte Optimum Installer

4.98

SUPERAntiSpyware

PUP.OptimumInstaller/Variant

10327

Trend Micro House Call

TROJ_CLIKUG.A

7.2.274

Trend Micro

TROJ_CLIKUG.A

10.465.01

Vba32 AntiVirus

AdWare.iBryte

3.12.26.0

VIPRE Antivirus

Threat.4778314

29418

Zillya! Antivirus

Adware.iBryte.Win32.854

2.0.0.1790

File size:

90.5 MB (94,928,387 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\p3d-tt.exe

File PE Metadata

Compilation timestamp:

5/11/2014 3:03:33 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1572864:Z9BatjlcVhWJRMCRHzR2nRoqjH0dY+j2aGEUqvE4+dkw3MFm1qYeqWkN0OlzMMXO:rBaJlcWJzSCqAi+AKEjdbvdWVOlAMXMJ

Entry address:

0x31FF

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 14, C7, 44, 24, 10, D8, 92, 40, 00, 89, 6C, 24, 1C, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 34, 71, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 58, 92, 42, 00, E8, 9F, 2E, 00, 00, A3, A4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 58, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, C0, 92, 40, 00, 68, A0, 81, 42, 00, E8, 0A, 2B, 00, 00, FF, 15, 38, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, F8, 2A, 00, 00... 
[+]

Entropy:

7.9999

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file p3d-tt.exe has been seen being distributed by the following 8 URLs.

https://docs.google.com/uc?export=download&confirm=8yFK&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://docs.google.com/uc?export=download&confirm=ZuFt&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://docs.google.com/uc?export=download&confirm=u3e8&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://docs.google.com/uc?export=download&confirm=Hgvk&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://docs.google.com/uc?export=download&confirm=eDpW&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://docs.google.com/uc?export=download&confirm=mgv6&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

https://doc-04-70-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/iqo2dg4igrihhpo37q186g6agj1dl140/1407254400000/13782527164821806504/.../0Bws7oU53Td62dGQ0Nlp6eGJhM0E?h=16653014193614665626&e=download

https://docs.google.com/uc?export=download&confirm=YSUN&id=0Bws7oU53Td62dGQ0Nlp6eGJhM0E

Remove p3d-tt.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.