home

simcity.exe

The application simcity.exe has been detected as a potentially unwanted program by 23 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from gfs.ezdownloadpro.info a web site host known to distribute potentially unwanted software operated by Rafael Leviev.
MD5:
f51767f1ee02498b7493b86db7f527ae

SHA-1:
14cc83ae9f1bacd48c19e3bd0be6c74b9fb37d52

SHA-256:
f6c5a2c4ac27696eb9340f0a9e2474e84c3f3456ee80d65307c1704ca05222c3

Scanner detections:
23 / 68

Status:
Potentially unwanted

Analysis date:
4/29/2024 1:30:28 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
6751608

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.03.08

Avira AntiVirus
ADWARE/MultiPlug.Gen
7.11.214.168

AVG
Adware Generic6.RSI
2014.0.4257

Bitdefender
Gen:Variant.Adware.Mikey.8516
1.0.20.330

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
21332

Dr.Web
Trojan.WebPick.5334
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.FK application
7.0.302.0

F-Prot
W32/MultiPlug.H.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey
5.13.68

G Data
Gen:Variant.Adware.Mikey.8516
15.3.25

K7 AntiVirus
Unwanted-Program
13.200.15187

Malwarebytes
PUP.Optional.Unizeto
v2015.03.07.10

McAfee
Program.MultiPlug-FWG
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
16.0.0.198

NANO AntiVirus
Riskware.Win32.MultiPlug.domoua
0.30.0.296

Panda Antivirus
Generic Suspicious
15.03.07.10

Reason Heuristics
Threat.Win.Reputation.IMP
15.3.7.22

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.15305

Sophos
PUA 'MultiPlug' (of type Adware)
5.11

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

Zillya! Antivirus
Adware.MultiPlug.Win32.213920
2.0.0.2090

File size:
1 MB (1,051,136 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\simcity.exe

File PE Metadata
Compilation timestamp:
3/1/2012 4:31:14 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:0OVOodl9DszjZsYsMhv7rqfV3don/lXkQWukWHWUv5gFNRtLZ1ATh:05c9AzjRsAzWt/uLHl5g7Rtd1AT

Entry address:
0xD9932

Entry point:
E8, DF, 14, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 50, CD, 4E, 00, E8, E8, 19, 00, 00, E8, AC, 16, 00, 00, 0F, B7, F0, 6A, 02, E8, 72, 14, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, E8, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
889 KB (910,336 bytes)

The file simcity.exe has been seen being distributed by the following URL.

http://gfs.ezdownloadpro.info/hp/?q=he/L5f6/qnekENPRJLtbcxcJqM6J5cIzcqDuwxpeHtY3DRav2mkrnn95/e z3z/FsvlWXHaJmf3wyd8hZv627nSeTYIQjaiFccOXq23AdI/xWEEOo7Y5llPjCuU4IVt9S XgRXWhAOhsc8 FJlR5FZE0kGfYL0or h4yvJyLzE0yapC3/On8gT1LBo88JoeC7cGQddvzWmEkdhqfEXb5z4SIr8isNHHEOpxOegmsYbDiEK6JAvArmQbDAeuYoZjY7OvO0ghLA0weXFfpKZJX4Ecc6JFSV iKt10sotBiuucqXUn9aZ/.../5nd7i8yZ6ScxVI9IRuNZlqKr0GWP7fcWFqTVp4CoRp32c95YwI1xfdkXHTRJ7iQkPtWAotZS4CPGdqTdTwrecJAu2IXdzeSNrAnsomznbf2fzrzlbLVfEegsHVu6I hYj7 mux6L2 QOGkaKTFN7EFDEhbQGChe3em0Sa7u&external_id=1424927150192871284&uuid=zjvCuQOGEA8VE2wj6vEgbcEcEqard1tql5VvCHQeyorHi3m1IN8lqC6EJCylWaV6X7r4LZt5IEJIwYM0mDOaguKO36mVtyjNJ9PC77l8TLVP0WLlvgHl9IT0hPOVaBPbhC4ZOB1feGLFw7CGJW7zrVCSA7kQMYms5byTOLXxtpkzplyeYJvaDoW8HHndMfpmJ2SgRUjMyL16IVkhxAwt9opB4UIO12PtWS4KTtlxI4fRSmVHA5In0tRtE3IC0zMJKsBW4epXUxRlEeJQRDnPi7d9VAou3wn0lKvnkgvWWIZCDYXTDeQYPqwRWTE3S89lRfING2l0tYDNYK1dc0qomnxt8Hh2VAwRFbaXyI2uZqLBcWWWwObkNgyXlTV4xYgttjh34al0cWZNPhjeWRz9KGKBe9xAVAOyFodV6NBCzsNvABeXxMnSrnMhpcs3

Remove simcity.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.