home

pakistani-girls-mobile-data.com

Pakistani Girls Mobile Data

The file pakistani-girls-mobile-data.com, “Pakistani Girls Mobile Data 1.9.5 Installation ” has been detected as a potentially unwanted program by 15 anti-malware scanners. The file has been seen being downloaded from serve.popads.net and multiple other hosts.
Publisher:
Pakistani Girls Mobile Data

Description:
Pakistani Girls Mobile Data 1.9.5 Installation

Version:
1.9.5

MD5:
c800a563539fdbbd6c61a19e91269d99

SHA-1:
07a3affc37e8ebc3abfbff5a5a9a8f69c75afc93

SHA-256:
694bd5d4c4d60fe42e0ef051fc82ab3801c829a0cf9ba9849e2361e89fd46c49

Scanner detections:
15 / 68

Status:
Potentially unwanted

Analysis date:
5/5/2024 8:45:53 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Heur.SMHeist.3
458

Arcabit
Trojan.SMHeist.3
1.0.0.585

AVG
Win32/DH{Bw?}
2016.0.2936

Bitdefender
Gen:Heur.SMHeist.3
1.0.20.1540

Dr.Web
Adware.AdClick.2
9.0.1.0308

Emsisoft Anti-Malware
Gen:Heur.SMHeist
8.15.11.04.04

Fortinet FortiGate
Riskware/Sim
11/4/2015

F-Secure
Gen:Heur.SMHeist.3
11.2015-04-11_4

G Data
Gen:Heur.SMHeist
15.11.25

K7 AntiVirus
Riskware
13.212.17725

Kaspersky
Trojan.Win32.Qhost
14.0.0.1174

McAfee
Artemis!C800A563539F
5600.6592

MicroWorld eScan
Gen:Heur.SMHeist.3
16.0.0.924

Panda Antivirus
Trj/CI.A
15.11.04.04

VIPRE Antivirus
Trojan.Win32.Generic
44974

File size:
196.1 KB (200,764 bytes)

Copyright:
Pakistani Girls Mobile Data

Language:
English (United States)

Common path:
C:\users\{user}\downloads\pakistani-girls-mobile-data.com

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:zZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6XmOD:lANwRo+mv8QD4+0V16XVD

Entry address:
0x25468

Entry point:
55, 8B, EC, 83, C4, F0, B8, 88, 53, 42, 00, E8, 24, F2, FD, FF, B8, C8, 54, 42, 00, E8, 2A, 1C, FE, FF, 8B, 15, 40, 88, 42, 00, 89, 02, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, 48, 88, 42, 00, E8, E4, D3, FF, FF, 8B, 15, 40, 88, 42, 00, 8B, 12, A1, DC, 87, 42, 00, E8, 7A, 64, FF, FF, A1, 40, 88, 42, 00, E8, AC, 4E, FE, FF, E8, DF, E0, FD, FF, 00, 00, 00, FF, FF, FF, FF, 01, 00, 00, 00, 2A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6123

Developed / compiled with:
Microsoft Visual C++

Code size:
145.5 KB (148,992 bytes)

The file pakistani-girls-mobile-data.com has been seen being distributed by the following 13 URLs.

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=4766530652064&m=-1,-1,0,0,0,-1,-1,2,0,4,-1,-1,1152,773,1152,834&iuid=3379067290&pl=!r8kdGK7Vu6n9eJQW10LAbD3VrDyk5BWhiKXoaGALXUy gjXGLrM58KbDyO/dDYMHOf6vsxIFjODfWkVaa4oG1xgA3zLpbaGfpKxNk6Wc6fAY8jzpeVB5Yb1zC9Fs1mWb468Q6BirXc/AgUivnASgW8x9CQMucCVPgA/HiYfdEyuIIbXaN0xcl3rAQvV0WvHSLK0bjgoD2zUuXay1DpYh83ooRzdi6AqxCbsOp25jm/Tup1Hp7NwKrNaBeMHQP3QPi6LCmi/sqw6oQdqMpACqZ5eEJ39bwokqGGjIF2kkabRqbjRUjUcHr6dLGlOhipRAKI8q01KtAOU8rEG4dz6rixfpKfx/.../wA==&ac=8708913373752038&jsv=017

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=2934002117340&m=-1,-1,0,0,0,-1,-1,1,0,1,-1,-1,1366,768,1366,728&iuid=5645844402&pl=!f/aVIgbv3mkKaI09wdh1RR9Qt1m/GDIpr0AcT4hm 1kQW11MfeRz4SPO5Mbsz1176aokFBEdhfOwHJXG9CcLd0DG5kHLxt6qypl3u8 qBJkO47qo6v7B L3PztwlVPlcSbMSAiwZAnTUF6glXjm/k9oIGFkdbByAGSaYTAIntvA5C94sRTsSJLkXlo2FnJlsJo4dFqj9/sFHsPNWkb/IHBXhgaCdngEO42BYsljEL5JDRS24T7l0dpBA0FTknxPNz4C/iFaQgY4yjqeb8OWwEboOz167D0x9xy LYiQqNleNKbOIF5z550Vn5LxN7/yfA7fbOSSZ5HVmjhhIwasiN4WP1p13irpVG7iBePOqQBJEdJ5F/6nhhKtx/.../8eSk2jheBmycOR1wQryjpeoJP8UkaC8IfF8JwpDw==&ac=3327749845410809&jsv=017

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=987343099920&m=1019,1196,322,4061,96,1340,945,43,88,12,-1,-1,1366,586,1366,728&iuid=1384764438&pl=!RVxz3rtmgv2zjI/enwkjhZaLq BTUERb742ERXw69Nzz/x vBtD8lNyuvavIR67UO/szy42b8lP1ACkpkExIpGiL3soE8RGrCc74UJ8FpGc1qBEku3h8OZgzEjCtGXHcmaYsUS1I1vFaSewwdzPsUTWEmV8SW1zsmYzLGyAsnLwnPUImY DoCT1HI49ngpXkCQ5r9YpMsqID03GedCjA/.../81Gq6IypmRgsUzCgDs3cbDytxDq9A0sV2tE13H61N2Qe2Okcgg==&ac=5430943461880753&jsv=017

http://nl1.ero-advertising.com/popads/logview.php?spaceid=337404&siteid=83379&xref=0rGh0hbXtnpNEhcSRKlbTKRAOqiQqNqy62wQd8mWR8GbyJIvLDYKrOE8AcG9a4k9mDTaosR6dnjw0SEkxLQFJjMCClPkj9P9Wpc X4zk cMirEQt QYq15FJc bY9R7SRSDsSyXfJIxGFZHJotUifxzL1Zk9NcIDeDxVwf/MscGGRiR3ZymYmVrszQA/.../JTg==

http://pops.ero-advertising.com/popads/logview.php?spaceid=1988222&siteid=83919&xref=ZFJrWnUBtHYHQW5OUqAUTYhEbqyYDKbT1ZQAvm3rWC7v9SRFnb cdLj ypjW0HmvRI12beprFFn3u05jrzAZA0 3dbEKWWcLBZPHrOt/ASaH8bCwAslvI7iL71SwwSrVTmGd9/7bEeS4R5vc2qu67C/FBB3kKLqFwyS55c/.../czwrD18x2Udtkmpg1iI0yPAg6LXjcdU 0uSOGZqTyKmgd9tn 89USdXYA534znWvAoyy9DOBIs3ST DVmyYfQ8O3AXO8cZfczFd2ruiGYAmdxg6jarmpBt6m13V3xhgNa0zXVJz9eusLkVEBLgmCqby fDSzojdqlQnA2kShwujvzRU=

http://pops.ero-advertising.com/popads/logview.php?spaceid=362978&siteid=83919&xref=mQBbmGDJa3dId6gsted1mR 6w5t8hUvrGYBZqWUu20kGzSH dB0xmPIc0mwBknJlXrlIAqGtuXpQEVFqi8hGY3xFDokwmYqE BOe5tt/duuFDqL4C9pLR77UxSB0jhWoXmDxE9do 7CX/.../NuBh8sJHBn5rGRYxLmFVJr2N2AdeY=

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=4766522436828&m=293,168,131,648,48,484,319,34,0,4,-1,-1,500,350,1366,728&iuid=8957536927&pl=!dBwr y9D3GC5T7P 4rAy8DzHGGh7WSfCzaFXdbpioZWWrx8Z2KAbIRNvzGRFFRNEri2mBC0VVpuiC2/7BJXEb3cwo qcozKJZs0DgeVPcbqB VCFFTM6wivqIGtr66PNloljVC6hWOHsKdTTmo2UYTU6aEG7JxMGbsBdSLHZmD6DEzeptgR3/Ej2LFbhmSwHW1o Q04kMs8 f86o7H/k0n/c/.../xaKHn6qdwZ4eeFNKBfX2r9glFqqH Pe9haaEYbRUCbxBTndGU8g5g==&ac=9223539064334109&jsv=017

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=3081829109544&m=612,493,80,2240,492,440,331,5,0,8,-1,-1,1366,630,1366,728&iuid=9045346247&pl=!rwMVAcczb3wEs6N9CMTwlGWzLKe9oZHxpplPhb8XoqvBYR0DVDRt7HKkz9hLiMV1ltllcyZ6b bCQKPqUoFLKu4ftHzKRy84GRiiTAK7np9dp2b5udTrtVQempGQvoWsAeCgzhGTwMhkhYPy2OMkThzyDoBCaSqhSH e7uB5 CHBkVuSOTaq2oejhFhFXh4AcebQcWfK upOFywTSwFsAJ0RLDFK6hdKB7ms9FSkP9Pg1BYMGnTBVM5nB4g5gRCJv61ObB2EVxICjYYaLtNygA==&ac=8204349048401089&jsv=017

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=988902527256&m=325,80,1,0,0,325,80,1,0,5,-1,-1,748,450,1366,728&iuid=3226836233&pl=!on85TSVvDyIg7/UqDx3ev4l05/xmBuJZkD0WP5bdwhy3jz GYFdx6dp0KCaVbaXi5b43MHHJ BtjU6G0vwerruBj3OlXFMfnmslsiA y3QwZoX5BoJBg5u5oxvrwmRjlSjDU71RiTH 34 2/cYJnz5/LCq0quqmocWRjItXmkVL0e0 wyXtwAwUHKlCLg0Ep81Cj76KgEoow/szmy6WvfdyE/.../85iRM6cs6nYFc0hJ0D3nKxf9Kek0U4jDWcQTIjVBzDQ==&ac=1501887760119427&jsv=017

http://pops.ero-advertising.com/popads/logview.php?spaceid=1991380&siteid=46239&xref=9A759VLI2aUA75tK8xfU/jX1pdnUAp1cVhw4NyPjTo/L9Q3zK0GJadM6YpIZgXbCCYss/tlUVEKNnXttyT DxlIGLaK5huGuG6s2X/cMZ3lnPNHtRiM/X/JqPPjrMNtHzFDR7lDd3rn40lFSh9GW5KxIQaES6AXwXtoJ/Qj6MP/ipb3Ln GmeHNkkEyAYtrt4ObiBiHAzrH5F/LkM7dWcmljAke7/6Fi4GxZIe2H9I8/pwEHXTl2LbTkDY4qK28ar7HorE8CCxGU0zWGzrT0QlD4Wb2IJ18FI/pPnIGri1q1 r/.../Lx0Y17tlbYePv8Q==

http://serve.popads.net/popOut.php?c=10000000000&wact=&a=2934023108220&m=899,339,6,92,25,988,366,7,0,3,-1,-1,990,557,1366,728&iuid=9507622239&pl=!MPrjDCzOmyv/qWEJGmXjLdeVTCyP/krBPdOeS1l fmy8UOWJ2Z077BiFWM9KFhQitIGIQXSm oIUB2XftTvp1xQ/8OqfN7qlgOP GEB/Wdw3dnm23Ykv9acYbzNfAcm6qPyyUbrSrjzBm89JxCXFZq7S3BDhBG/RSqB6tQCQ36ccF523 PoLmFplc54B/5QPxLLifsLIZnsmuDaFG5taWKLduzLMHSGvzQgUWRql1Czxeux5JFmiaTJmHkpUBoX5Y3dZ7xdO7uGprC8dEk7EeQaiGKKM/.../K1FED7zsY=&ac=2119557568355324&jsv=017

http://nl1.ero-advertising.com/popads/logview.php?spaceid=2022660&siteid=57183&xref=ttLwBTsjAA40jCI952J V3QiOSft/0uHzyLNhDp12IQu QXbdHxcvYrCnzxG3jzErNNjicTpcFA31KUw7tV9m3kv4aQq/zf38EfYvTJGB2wdPZtagaXufxQ3JoOs C53LUx6q8gQN4cS8NMLH4RPPPKuT53j7HfsCoznxadMCr hwGvHLUNR0WG4oy9Bp49au12UcQa/fP nEqwBKlWTumYTfDlS8qvTufNrPRh0g58JcbONIEEx16Nkwh3oC8cWL29NS/.../XpuXVKgSX7MztdfsDpCp jdnXY JMmR5LWptk=

http://onlinestudy.pk/.../click.php?id=3

Remove pakistani-girls-mobile-data.com - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.