home

PutLockerDownloaderv2.exe

PutLocker Downloader v2

CoolMirage Ltd.

This is part of a CoolMirage installatation, a potentially unwanted program (PUP) that display ads on the computer. The application PutLockerDownloaderv2.exe by CoolMirage has been detected as adware by 4 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com and multiple other hosts.
Publisher:
Cool Mirage  (signed by CoolMirage Ltd.)

Product:
PutLocker Downloader v2

Version:
1.1.4.0

MD5:
95f6fe9350a3c1552a7b561f99a4fd3f

SHA-1:
eef9df0fca0fd9def4ede809cf9c245f78e1562f

SHA-256:
ee83ca34e9cccdc8449f121fa3a05add5c9c0133ae514288c32af3967c9e955c

Scanner detections:
4 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
4/24/2024 2:00:44 PM UTC  (today)

Scan engine
Detection
Engine version

Boost by Reason
PUP.CoolMirage.V
2013.11.20.0

herdProtect (fuzzy)
variant of ftdownloader4.exe (Adware)
2013.12.20.16

Reason Heuristics
PUP.CoolMirage.V
14.8.7.17

VIPRE Antivirus
CoolMirage Ltd
24658

File size:
2.5 MB (2,673,144 bytes)

Product version:
1.1.4.0

Copyright:
Copyright © Cool Mirage 2013

Original file name:
PutLockerDownloaderv2.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\putlockerdownloaderv2.exe

Digital Signature
Signed by:
CoolMirage Ltd.

Authority:
Thawte, Inc.

Valid from:
6/5/2013 5:00:00 PM

Valid to:
6/6/2014 4:59:59 PM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
7/15/2013 8:51:47 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:iqDHZK6KDT1Y8D+2kUXbvKUeeZsssgMzAtwi2NlRp3j2J3pK761Y8SeHDTRz3P95:ZDXk1ZkAmUeeZsssjEtwi2yJ5p13DTZ3

Entry address:
0x288C3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9339

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.5 MB (2,649,600 bytes)

The file PutLockerDownloaderv2.exe has been seen being distributed by the following 2 URLs.

http://cmpsmarter-downloader.maynemyltf.netdna-cdn.com/PutLockerDownloaderv24.exe

http://www1.installsfiles.com/PutLockerDownloaderv24.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.gogrid.com  (173.1.98.105:80)

TCP (HTTP):
Connects to v-2-do12-d1336-26.webazilla.com  (78.140.132.26:80)

TCP (HTTP):
Connects to mrs02s05-in-f0.1e100.net  (173.194.35.96:80)

TCP (HTTP SSL):
Connects to fa-in-f95.1e100.net  (173.194.70.95:443)

TCP (HTTP):
Connects to edge-star-shv-03-mxp1.facebook.com  (31.13.86.33:80)

TCP (HTTP):
Connects to ec2-54-235-103-243.compute-1.amazonaws.com  (54.235.103.243:80)

TCP (HTTP):
Connects to cds5.par9.msecn.net  (94.245.70.10:80)

TCP (HTTP):
Connects to a23-50-177-224.deploy.static.akamaitechnologies.com  (23.50.177.224:80)

Remove PutLockerDownloaderv2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.