home

the-walking-dead-windows-theme-1-0-es-en-fr-de-win.exe

The Walking Dead Windows Theme

WinThemePack.com

The application the-walking-dead-windows-theme-1-0-es-en-fr-de-win.exe has been detected as a potentially unwanted program by 16 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts. While running, it connects to the Internet address static.5-9-51-208.clients.your-server.de on port 80 using the HTTP protocol.
Publisher:
WinThemePack.com

Product:
The Walking Dead Windows Theme

Version:
1.0.0.0

MD5:
e571c56fe1db252c2412cb76fc2c1246

SHA-1:
630c224e35dd69ef313de9fec15bb3a45e8899ca

SHA-256:
4d52638653cfb4c9b2b54c86737199dcd02e99e0cc25314c899a3e5cfc7b2cf7

Scanner detections:
16 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
4/26/2024 3:30:55 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Conduit
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
8.3.2.2

avast!
NSIS:Adware-NG [PUP]
2014.9-160107

Baidu Antivirus
Adware.Win32.Conduit
4.0.3.1617

Dr.Web
Adware.Conduit.277
9.0.1.07

ESET NOD32
Win32/Toolbar.Conduit.S potentially unwanted
10.12436

G Data
Win32.Adware.Conduit
16.1.25

K7 AntiVirus
Unwanted-Program
13.211.17590

Kaspersky
not-a-virus:HEUR:WebToolbar.Win32.Conduit
14.0.0.855

Malwarebytes
PUP.Optional.Conduit
v2016.01.07.01

McAfee
Artemis!E571C56FE1DB
5600.6528

NANO AntiVirus
Riskware.Win32.Conduit.dxppsg
0.30.26.3947

Qihoo 360 Security
Win32/Trojan.Dropper.c9f
1.0.0.1015

Quick Heal
PUA.Conduitltd.Gen
1.16.14.00

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.4

VIPRE Antivirus
Conduit
44682

File size:
14.7 MB (15,420,671 bytes)

Product version:
1.0.0.0

Copyright:
Copyright (c) 2013 WinThemePack.com

Trademarks:
Copyright (c) 2013 WinThemePack.com

Original file name:
The Walking Dead Windows Theme.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\the-walking-dead-windows-theme-1-0-es-en-fr-de-win.exe

File PE Metadata
Compilation timestamp:
12/5/2009 8:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:2cdNbITJArJL4iz0lR+eo2KtoBnKh1TvkmkFnzGPlCr:26RITJArR4uS+pVtoBKvImGn8lCr

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file the-walking-dead-windows-theme-1-0-es-en-fr-de-win.exe has been seen being distributed by the following 3 URLs.

https://dw.uptodown.com/dwn/6dVAmc1dAMjHRgqV6Qd3KhYp2k01NLYldko1-cIm6l26IusYcIi_ngkKmlfr4HxDsX51HI8naFnQkZXJc-ViNNCLOLZ-ntdSbX-JIUcizVspWDN_xmgzhyFxREDZLz6T/rOiCqZPEiK7etmfKQR8uY8HZ7vgBC0byAlwiuOl8eFrBjGN38t6gCw0ienk3giL0r-gP5qWGSlXfPBiTgQ7THcRPW88znlNi59wtdZFgpNxcKJiWPNzlnUwRrlwfPyNk/TebkYfcsc98hwih10P9J9-nP6_a789TYrLcflp26M76Q4J4lq_kOJ0gGhZrEVdlSqcnmjrJpHADF6tCvZoInwdHa01yIPpa_nnSE3atcErPEhcDqspU3t_10d9IuWNgm/.../

http://dw.uptodown.com/dwn/bQWeMZw3TqmhvyXjKXxSEompunKlHHV_Kde2Wg_ClVLuz4plcpuAWmIf_8zSmpBSjGRA4WgHjoFn1_vCsqwT-EgQ_fJsDMHlN9-38QKl9SKdIlkqrJhpn8D0DA6SJTme/2Yszd-NbeHB8LDE8T3XYRYbNUILnjQ6gyQ7IPcaS5N99GMBJ7sZTchg3EI_TmGhHuijIZDft_juGMfCAaLUbkN3dbcN4f2m3LdDfJnx-ly5WFFGaHRgW8c9t8Zz4K5xj/fuCHupV2Tl9h2Dl4Del_e2VTYqwkzmjOa8UZuMpExafT_wQKAH1krrUKtdvlI7g6JWJHH1ix0gnIVkkZxCD6qqmEwCpkzsY9jgzRA3SvJq9u1iZEQiJLfAuNQqOuWc0H/.../

http://dw.uptodown.com/dwn/zuhh6HkdizyXcyQKKDjhycibcK3UxSno_-7c7UKa-gxiJnvcgW4Yn2J7H7dfPcFiE-G2d3qXgFQm8EboMDOi-GixkGknOCBQ4urFoZC6llFPlsq0CDGXfMlieEM2gs3h/DUCSoRndJ5lOxU5pOyQSQzqqBI9Dq31pzUD39q6nRZ1ymORzEqBMAm9-4KU94AMAntHVMgOapcmY29GUbsghzpE6dUY534ASmQazRMVlwkwvDinExs4cNo3Shvp-qdau/uYovp7G2EKNb0qRnhy6DpLVMyfhhJHjEr_UDZQcIJ9bP61V0GWBIdWb6KlkITrU96CBIhlovxF91A0Zh2g8OHO2bAs4eVwRd-IKWW9SOawLg8RoHlBr2MqS5rVETPRtw/.../

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to static.5-9-51-208.clients.your-server.de  (5.9.51.208:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.