home

simplefiles_downloader.exe

SimpleFiles Installer

New Monte Inc

The application simplefiles_downloader.exe by New Monte Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 390, 1

MD5:
3f81425446eae481817aa900bfe4e6f5

SHA-1:
89b00f49d7d7eecdcac44b19d673abdb69894cb8

SHA-256:
ded539e6cea1dd98389c6a3124b4d865295202a65b581ffb189d633f624dd41b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/28/2024 6:21:35 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Blisbury.NewMonte.Bundler (M)
16.7.5.20

File size:
3.7 MB (3,876,216 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\simplefiles_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 5:00:00 PM

Valid to:
12/6/2016 5:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
11/24/2014 9:03:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:xKK+ybP53JUgsflLOFG526PL+7ECBCMl3CORvfmYr:8mh3SQGPL+71l3CO4Yr

Entry address:
0x6F3BBA

Entry point:
E9, A5, 63, 07, 00, 80, FD, BE, F6, D0, F5, F6, D8, 60, E8, 49, 62, FF, FF, DF, B1, 4D, 88, 16, 04, B0, C5, AE, 26, 8B, E6, CD, AA, 10, 2C, 09, 1E, EE, 01, 7D, 05, EE, 66, CB, 1D, E5, 23, 1E, 46, 50, 16, C6, DE, 91, 0F, 7A, 12, 8D, C7, DC, 44, D0, 56, F3, F0, 01, 73, 36, 9C, 5A, E3, 14, AE, 4C, FC, 6A, 16, 49, 9D, 0B, 81, 8B, 73, AA, CA, 3C, B6, BC, 44, 7B, 1F, 5E, BC, C6, A2, D5, 99, 98, 64, AB, F7, 15, 88, C0, 0A, 41, C2, 0F, 84, 50, 87, 65, 47, 14, CF, D1, 25, BF, 6C, 4D, 2C, 50, 66, CB, 1F, B1, 55, B1...
 
[+]

Entropy:
7.9285

Packer / compiler:
Xtreme-Protector v1.05

Code size:
968.5 KB (991,744 bytes)

The file simplefiles_downloader.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5HjQ3GN A83jPoPMo/peijPoCV7pORyL/Hlezy4gCFqooAlfbmNZhXymS1LvpcKTYOBHkKFxFoHwp4DU4tqTg/KcRMxr2EUNYAwCyKdcOc9knDzfGN25nBwefwFa07mMHhX7l9Fer0UcUzzNXtdyg13askdHQmNAkBO8BNYfIZOAnKOrAd4lbcMepn/WQ6r7089 qcjbP7yIG38rXwF4qp/AeSUaFzsw2MOu5NsRdeabBfUlBUY1vUsW4PdVeSdmA/kg/.../kTWqscQxifXQJoWnyyvSoIRC2aqAFJPC3RqXkYQfz5jzCsmUowEwhvtZIMSiTX6F43Q2jeE=

Remove simplefiles_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.