home

parent.txt

Awimba LLC

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file parent.txt by Awimba has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. It is also typically executed from the user's temporary directory.
Publisher:
Awimba LLC  (signed and verified)

MD5:
d49f5029d29558310906ab4edce8641d

SHA-1:
dd933ad91aaa6772879f02f552f2bcbfc1f5c87d

SHA-256:
64b776ddff518e3c9d7659c86dc5ed51271c4d5760bd1d1cbe730d018ab1fe5a

Scanner detections:
31 / 68

Status:
Adware

Explanation:
Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/23/2024 5:25:00 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Dropped:Application.Bundler.DomaIQ.Q
836

AegisLab AV Signature
AdWare.MSIL.DomaIQ
2.1.4+

Agnitum Outpost
PUA.DomaIQ
7.1.1

AhnLab V3 Security
PUP/Win32.DomaIQ
2014.10.22

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.180.106

avast!
PUP-gen [PUP]
141003-0

AVG
Adware Skodna.Generic_r.IA
2014.0.4040

Bitdefender
Dropped:Application.Bundler.DomaIQ.Q
1.0.20.1475

Clam AntiVirus
Win.Adware.Domaiq-18
0.98/21411

Comodo Security
Application.Win32.DomaIQ.D
19871

Dr.Web
Trojan.PayInt.27
9.0.1.05190

Emsisoft Anti-Malware
Adware.Generic.994668
14.10.22

ESET NOD32
Win32/DomaIQ.AV potentially unwanted application
7.0.302.0

Fortinet FortiGate
Adware/DomaIQ
10/22/2014

F-Prot
W32/Backdoor2.HTIW
4.6.5.141

F-Secure
Adware:W32/DomaIQ
11.2014-22-10_4

G Data
Dropped:Application.Bundler.DomaIQ
14.10.24

IKARUS anti.virus
not-a-virus:AdWare.Win32.DomaIQ
t3scan.1.7.8.0

K7 AntiVirus
Trojan
13.184.13741

Kaspersky
not-a-virus:AdWare.Win32.Lollipop
15.0.0.494

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.10.22.04

McAfee
Adware-DomaIQ
5600.6970

MicroWorld eScan
Dropped:Application.Bundler.DomaIQ.Q
15.0.0.885

NANO AntiVirus
Riskware.Win32.DomaIQ.csmcgi
0.28.2.62841

nProtect
Trojan-Clicker/W32.Lollipop.459768
14.10.21.01

Quick Heal
Adware.Domal.A5
10.14.14.00

Reason Heuristics
PUP.Awimba.J
14.10.22.4

Sophos
DomainIQ pay-per install
4.98

Vba32 AntiVirus
BScope.Downware.DomaIQ
3.12.26.3

VIPRE Antivirus
Threat.4783262
33706

Zillya! Antivirus
Adware.DomaIQ.Win32.43
2.0.0.1962

File size:
449 KB (459,768 bytes)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\parent.txt

Digital Signature
Signed by:
Awimba LLC

Authority:
DigiCert Inc

Valid from:
5/10/2013 10:00:00 AM

Valid to:
5/15/2014 10:00:00 PM

Subject:
CN=Awimba LLC, O=Awimba LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
09A928EF40E9E87418147E2639362A6E

File PE Metadata
Compilation timestamp:
1/10/2014 3:46:35 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:HOeTIfnjAEkxJPNeaL9uRqQb3fgnFwFGLgJ2k0SyCKF1pYax6uYj+LHHYVf:yAEOJPNeapQrgjLgJoSyCuDYax6hj5f

Entry address:
0xCCE2

Entry point:
E8, 94, 5E, 00, 00, E9, 78, FE, FF, FF, 6A, 0C, 68, 88, 22, 42, 00, E8, C4, 04, 00, 00, 83, 65, E4, 00, 8B, 75, 08, 3B, 35, 58, 88, 42, 00, 77, 22, 6A, 04, E8, 7F, 60, 00, 00, 59, 83, 65, FC, 00, 56, E8, 86, 68, 00, 00, 59, 89, 45, E4, C7, 45, FC, FE, FF, FF, FF, E8, 09, 00, 00, 00, 8B, 45, E4, E8, D0, 04, 00, 00, C3, 6A, 04, E8, 7A, 5F, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, 75, 08, 83, FE, E0, 0F, 87, A1, 00, 00, 00, 53, 57, 8B, 3D, 70, D0, 41, 00, 83, 3D, 1C, 85, 42, 00, 00, 75, 18, E8, 3A, 57, 00...
 
[+]

Entropy:
7.3917

Code size:
110.5 KB (113,152 bytes)

Remove parent.txt - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.