home

portfolio.exe

premium

Maxiget Limited

This is part of a bundled installer which provides applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application portfolio.exe by Maxiget Limited has been detected as adware by 13 anti-malware scanners. The file has been seen being downloaded from ds212.maxiget.com and multiple other hosts.
Publisher:
C  (signed by Maxiget Limited)

Product:
premium

Description:
DWD

Version:
3, 3, 9, 0

MD5:
0f4895af57bc201430b2bec9e89f89f0

SHA-1:
c05ac7f339bab9fa4b16a758c62ad458a664fe0a

SHA-256:
598e72682aefad4baea9d794bbb988ce4c7a9c4ec94f4e16ae0eb68e2d333d6f

Scanner detections:
13 / 68

Status:
Adware

Explanation:
This is a modified installer version of the software and bundles additional offers including adware.

Analysis date:
4/24/2024 3:32:10 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Strictor.58208
950

AVG
MalSign.Generic
2015.0.3428

Bitdefender
Gen:Variant.Adware.Strictor.58208
1.0.20.905

Emsisoft Anti-Malware
Gen:Variant.Adware.Strictor.58208
8.14.06.30.01

ESET NOD32
Win32/4Shared (variant)
8.9610

F-Secure
Gen:Variant.Adware.Strictor.58208
11.2014-30-06_2

G Data
Gen:Variant.Adware.Strictor.58208
14.6.24

herdProtect (fuzzy)
variant of أحجار على رقعة الشطرنج.exe (Adware)
2014.8.25.6

MicroWorld eScan
Gen:Variant.Adware.Strictor.58208
15.0.0.543

NANO AntiVirus
Riskware.Win32.Strictor.dbqzau
0.28.0.60475

Reason Heuristics
PUP.MaxigetLimited.J
14.8.7.21

Sophos
4Share Downloader
4.98

VIPRE Antivirus
Threat.4150696
29708

File size:
349 KB (357,416 bytes)

Product version:
3, 3, 9, 0

Copyright:
2014

Trademarks:
-

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\portfolio.exe

Digital Signature
Signed by:
Maxiget Limited

Authority:
GoDaddy.com, Inc.

Valid from:
8/15/2013 1:41:32 PM

Valid to:
8/15/2016 1:41:32 PM

Subject:
CN=Maxiget Limited, O=Maxiget Limited, L=Limassol, S=Cyprus, C=CY

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
045BA815265145

File PE Metadata
Compilation timestamp:
3/21/2014 7:59:37 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:wpXjY7kKuXbYyaO6FbgNGedVOB+jeIvny7brvyckglKyaC78JrsxyP1c+GDXJTUt:wxjY7eaCdVGnv6sMC78J/dMjJ/Q

Entry address:
0x2D3F1

Entry point:
E8, 5D, 89, 00, 00, E9, 78, FE, FF, FF, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41, FE, 8B...
 
[+]

Entropy:
6.3414

Code size:
255 KB (261,120 bytes)

The file portfolio.exe has been seen being distributed by the following 7 URLs.

http://ds212.maxiget.com/.../Minecraft Server-1.6.4.exe

http://ds212.maxiget.com/.../Wild Ones (ft. Sia).exe

http://ds212.maxiget.com/.../01 Rolling in the Deep.exe

http://ds212.maxiget.com/.../JB - When i cant sing.exe

http://ds212.maxiget.com/.../?????????-?????&????.exe

http://ds212.maxiget.com/.../Adobe Illustrator CS5 portable.exe

http://ds212.maxiget.com/.../Portfolio.exe

Remove portfolio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.