PutLockerDownloaderv2.exe

PutLocker Downloader v2

CoolMirage Ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application PutLockerDownloaderv2.exe by CoolMirage has been detected as adware by 2 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www1.installsfiles.com and multiple other hosts.
Publisher:
Cool Mirage  (signed by CoolMirage Ltd.)

Product:
PutLocker Downloader v2

Version:
1.1.4.0

MD5:
1a910d6219471c816e86d0ae92b426e1

SHA-1:
b37ba8abdaba4f9f67aa283554a046faeb57fa70

SHA-256:
e064b4d78fdd8fff9d828cb81a8d0fa0b2bd4d50a52f7f7dac68437b8df11d30

Scanner detections:
2 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
4/26/2024 3:35:20 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.CoolMirage.V
14.8.7.17

VIPRE Antivirus
CoolMirage Ltd
24346

File size:
2.5 MB (2,672,120 bytes)

Product version:
1.1.4.0

Copyright:
Copyright © Cool Mirage 2013

Original file name:
PutLockerDownloaderv2.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\putlockerdownloaderv2.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/6/2013 3:00:00 AM

Valid to:
6/7/2014 2:59:59 AM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
7/15/2013 6:51:49 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:EN46iueAhCCCGMzAtww2NlRp3j2JVpK761Y8EedltzV3P9J+bf+ukUIbsHvrr//g:EN4VueAhCCC9Etww2yJTp1HltxeZkzig

Entry address:
0x28895E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.5 MB (2,648,576 bytes)

The file PutLockerDownloaderv2.exe has been seen being distributed by the following 2 URLs.

Remove PutLockerDownloaderv2.exe - Powered by Reason Core Security