» pc worms armageddon especial portugues completo.exe
Overview
Analysis
File Details

pc worms armageddon especial portugues completo.exe

MIDIA TECHNOLOGIES LLC

The application pc worms armageddon especial portugues completo.exe by MIDIA TECHNOLOGIES has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Midia Downloader installer.

File name:

Publisher:

. (signed by MIDIA TECHNOLOGIES LLC)

Product:

Version:

1.0.0

MD5:

ada58135cac52da0db49c409f6eb1d78

SHA-1:

e4f846fb3a3a5f85ace6daa82bf167f1dea8ca1f

SHA-256:

6113fd2344c0f9bb573edfd504a6f52c74cd230b947257a077564969f7d41eb4

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

5/18/2024 5:01:49 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Midia Technologies (M)

16.9.6.18

File size:

362.3 KB (371,032 bytes)

Product version:

1.0.0

Original file name:

termosdeuso_so_nsis.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Midia Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\pc worms armageddon especial portugues completo.exe

Digital Signature

Signed by:

MIDIA TECHNOLOGIES LLC

Authority:

GoDaddy.com, Inc.

Valid from:

8/21/2014 10:27:01 PM

Valid to:

4/11/2015 3:45:06 PM

Subject:

CN=MIDIA TECHNOLOGIES LLC, O=MIDIA TECHNOLOGIES LLC, L=Lewes, S=Delaware, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

043AB639CD00E5

File PE Metadata

Compilation timestamp:

5/6/2009 2:36:57 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:OD+LsFV/+TjXLAVaE9kC4splJWWnVAtSrlOYXa+d19W3RFc8g2F5SNF6o+VwwAj1:ODPr/+j7i9kC4sbJhnVAtJH81iRFc8Zy

Entry address:

0xEF380

Entry point:

60, BE, 00, B0, 49, 00, 8D, BE, 00, 60, F6, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

340 KB (348,160 bytes)

Remove pc worms armageddon especial portugues completo.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.