home

the-sims-4-by_xatab-4397-torrent.exe

Amulet

The application the-sims-4-by_xatab-4397-torrent.exe by Amulet has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from s99e.storage.yandex.net.
Publisher:
Amulet  (signed and verified)

MD5:
92f575d8aea53774308ab1530accad27

SHA-1:
d617eb33b74c57285b49f774c340d08c2debf736

SHA-256:
df79fda4b16ff6661fe829bd4963670c2ade81c816de01996f8b14b4c5d5fb61

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
6/22/2025 12:23:33 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FileTour.Amulet (M)
16.6.20.7

File size:
1.8 MB (1,844,720 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\the-sims-4-by_xatab-4397-torrent.exe

Digital Signature
Signed by:
Amulet

Authority:
COMODO CA Limited

Valid from:
12/18/2015 2:00:00 AM

Valid to:
12/18/2016 1:59:59 AM

Subject:
CN=Amulet, O=Amulet, POBox=127015, STREET="Vyatskaya, 70, pom.1", L=Moscow, S=Moscow state, PostalCode=127015, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B48E86D275ECE7BFC0A62B206428EDAC

File PE Metadata
Compilation timestamp:
12/8/2013 10:30:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
24576:WjVubFo6FX95FTDeLkMAzPLEE7QvnwgxVMufQT4nT2yQx:wVAy2bne8EUawkw4T2Z

Entry address:
0x24F008

Entry point:
73, 05, 33, D2, 0F, AF, D0, E9, 1D, 19, 00, 00, 79, 54, 64, FF, 35, 00, 00, 00, 00, 68, B0, 01, 65, 00, 9C, FF, 44, 24, 04, 9D, C3, D6, 68, EB, F0, 64, 00, 9C, FF, 44, 24, 04, 9D, C3, D0, D2, 6D, 50, 68, 0F, 23, CF, 79, 9C, 81, 6C, 24, 04, 38, 1E, 6A, 79, 9D, C3, 3D, 68, 79, F2, 64, 00, 9C, FF, 4C, 24, 04, 9D, C3, 4C, FF, E0, E9, 56, 0E, 00, 00, 0F, 51, B1, B9, CD, 6E, A0, FF, E9, 80, 1D, 00, 00, 54, B8, 27, 7D, D2, FF, EB, 50, AF, 81, EA, 1A, 11, 0A, 00, 68, 5A, 0F, 65, 00, C3, B1, E9, 79, 01, 00, 00, AC...
 
[+]

Code size:
1.2 MB (1,224,704 bytes)

The file the-sims-4-by_xatab-4397-torrent.exe has been seen being distributed by the following URL.

https://s99e.storage.yandex.net/rdisk/61e5f00c58e983aa62f85afbca7b0ae2e9d970e29cb082b8000b34cb33ee83c2/573c8dab/GWSGeT_mZEOv4VVx61K3_g4dQtKmwMvMtqXrV7lEgkD0LhoWLMthlMjl-GMI7rD5YmqjcjbcHsLRO_Mm7HjLHg==?uid=358720970&filename=The-Sims-4-by_xatab-4397-torrent.exe&disposition=attachment&hash=&limit=0&content_type=application/x-msdownload&fsize=1844720&hid=7d06b213682d83093f217b1af4f4db5c&media_type=executable&tknv=v2&etag=92f575d8aea53774308ab1530accad27&rtoken=cBrZMpgNzfgO&force_default=yes&ycrid=na-94b92fa27396f86bb6574409f912cd4a-downloader10d&ts=5331fb8ae80c0&s=74e18ef60ea56f66e9f4df1b6433a4403e9483f981a4ba09639d8bdc0c94c3e3&bp=/23/.../data-0.12:43027907828:1844720

Remove the-sims-4-by_xatab-4397-torrent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.