home

the_modern_pneumatic_airgun_quot_book_by_h_m_buckley_downloader.exe

SimpleFiles Installer

New Monte Inc

The application the_modern_pneumatic_airgun_quot_book_by_h_m_buckley_downloader.exe by New Monte Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 263, 1

MD5:
828a06aad62928ec225118ef6383fdd8

SHA-1:
aaa4212ab71cbe8aa6aa46580f388fc31faaba30

SHA-256:
5f82ee8ca6c5b68fff30232dee79d8dd2dc6b16adc9defa59215f3b77ed73fd9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/29/2024 2:06:02 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Blisbury.NewMonte.Bundler (M)
16.6.26.7

File size:
3.6 MB (3,760,096 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Common path:
C:\users\{user}\downloads\the_modern_pneumatic_airgun_quot_book_by_h_m_buckley_downloader.exe

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 10:00:00 PM

Valid to:
12/6/2016 10:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
9/15/2014 8:34:16 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:/eAZp+xMgWMwmkj/yNEIE3ZNkBLsg8Ld91ObkKTMJWDHhMBeF:GK6Mlmkj/cdCIBAg81ObzFLFF

Entry address:
0x6C5D97

Entry point:
E8, 97, 3D, 00, 00, 2B, 4A, 10, 60, 54, 0F, BA, E6, 14, 3B, 4A, 14, 9C, 8D, 64, 24, 2C, 0F, 83, EF, BF, D4, FF, 9C, 8D, 64, 24, 04, E9, 9C, B3, FF, FF, 70, 59, 81, C1, 66, D8, F9, C4, F4, 94, C8, C9, 17, 60, 46, 7A, 46, 23, 3D, 54, 72, 26, BA, 0B, CB, C5, 7B, F0, 2C, C5, F1, E9, E6, E8, A0, 41, C3, A8, 39, 45, 70, F8, 2A, 67, D8, F9, F8, D0, 89, AB, 35, E8, B7, E9, 93, A2, E4, A4, E2, DA, 26, A3, 19, 6A, 63, 35, 99, 51, BB, 28, 74, 32, 76, 6A, 4B, 51, 3E, B8, D0, DE, 22, CC, 14, DA, 2E, 5C, 02, 10, BA, B4...
 
[+]

Code size:
947.5 KB (970,240 bytes)

The file the_modern_pneumatic_airgun_quot_book_by_h_m_buckley_downloader.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GRX2ebhFRi0b9RIei/JnvRtDN7o/IKf7a6OnTjsCZxuM4VTb CcGStxhcBldohW7 eC1eZ3x9F2cxbC9w3QA3cM05kg3wZL5AwTnrII7R62mXmIHR37iRbdOtnOwfnLG1D8Qtzdu8fZEiiWz5Szwd/XppABk3PBXtVwAlcfMcWSSTT8V4sz6hXItKsTDWw0V86svw0K7KrBg/p6C0Av8EvCb7BOza1yWlc d48ArzHLEjWilZX2YRQU96NW6/Cil6jgqMv4Zq1HLCZ k3yYa8Y8WHnsvht77ysPem9wCW8vMByhqKRI97xmDmf YxgprrZQM/F1w2VxckS15nnQ4zDoUJhxJZSYon8CizKsC1qgeZxK/T/Pyuj yR/.../vdYRS02GwV49RsSezFAR69kwYB0ZpcBN2ZDQ6LMVVOg3cDf8ExTnbC

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.