home

sid_meiers_civilization_beyond_earth_by_xatab-657-torrent.exe

Firefox

APEP

The application sid_meiers_civilization_beyond_earth_by_xatab-657-torrent.exe by APEP has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from downloader.disk.yandex.ru.
Publisher:
Mozilla Corporation  (signed by APEP)

Product:
Firefox

Version:
45.0.2

MD5:
126d6705d9b4fc68bae44c7512fc309d

SHA-1:
23b8c8b88a60890cad0d4831e50c8f6db60098e1

SHA-256:
ffa24765f7045b02f66886ce5fb6ef178f4ee13385eb5cda776c979629cfad94

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 11:17:39 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FileTour (M)
16.8.10.13

File size:
2.3 MB (2,402,736 bytes)

Product version:
45.0.2

Copyright:
©Firefox and Mozilla Developers; available under the MPL 2 license.

Trademarks:
Firefox is a Trademark of The Mozilla Foundation.

Original file name:
firefox.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\sid_meiers_civilization_beyond_earth_by_xatab-657-torrent.exe

Digital Signature
Signed by:
APEP

Authority:
COMODO CA Limited

Valid from:
6/10/2016 4:00:00 AM

Valid to:
6/11/2017 3:59:59 AM

Subject:
CN=APEP, O=APEP, STREET="Bajkalskaja, 216 A/5", L=Irkutsk, S=RU, PostalCode=664075, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
77C5C9138FCDB38AC8A8BF46C3C991C2

File PE Metadata
Compilation timestamp:
1/5/1990 8:18:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:diODMvxulMmmyqnG8DS47yo3/QEV//W0c1o2PK8hmB8nXdZ30KjQkhoG:DD09G8m4+m/Q0Tc17PJYB8/30SQM

Entry address:
0x462001

Entry point:
48, 33, C0, 40, 40, E9, 1F, 00, 20, 00, 00, DD, 43, 2F, BA, 0B, AB, 56, C0, AA, 6A, 28, 37, 97, 78, 2A, AB, C0, 75, 68, 75, 4D, BD, CF, AB, 0A, 56, 73, 76, 98, A7, 7A, 6D, EE, 70, 93, FA, A8, 4D, C4, 45, EB, 75, BB, 46, 60, 2B, 33, 71, 89, AC, 05, FD, EB, 5F, DE, 90, 13, D0, 1D, 35, 58, 17, 19, E3, 6C, B4, 16, D0, A9, CD, BF, DE, 71, 37, D7, 4F, 35, 20, FB, 31, 7D, 57, 08, 84, 1F, 7B, F3, 4A, 17, DD, 9D, CE, D4, AC, E6, 85, 26, 53, 3E, 9E, 03, F4, 51, C1, AD, A1, 48, E1, 2F, 63, B7, 00, 5B, D0, F3, 4B, E2...
 
[+]

Code size:
2 MB (2,075,648 bytes)

The file sid_meiers_civilization_beyond_earth_by_xatab-657-torrent.exe has been seen being distributed by the following URL.

https://downloader.disk.yandex.ru/disk/281bbd4040aaa24ca021df232f0f2214a9270b78e32d61caf63c9a7d92ec1220/57964d4f/.../x-msdownload&fsize=2402736&hid=b33af488467f5f969aae7fd129c5b574&media_type=executable&tknv=v2&etag=126d6705d9b4fc68bae44c7512fc309d

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.