home

tome_of_ultimate_mapping_downloader.exe

SimpleFiles Installer

New Monte Inc

The application tome_of_ultimate_mapping_downloader.exe by New Monte Inc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SimpleFiles installer. The file has been seen being downloaded from dlr8847.simple-files.info.
Publisher:
New Monte Inc  (signed and verified)

Product:
SimpleFiles Installer

Version:
1, 0, 511, 1

MD5:
f3f468b73eaa7505c9f3769ceacfbba2

SHA-1:
47a5c5f0445d775ebe2977442c40601c90a5bc9e

SHA-256:
d21601abca7b2652d516fdf48ccea886b771fa63e64bd19a287e22ca094695d5

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/29/2024 12:36:55 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Blisbury.NewMonte.Bundler (M)
16.6.26.6

File size:
4 MB (4,169,256 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://simple-files.com (C) 2014

Original file name:
SimpleFilesInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SimpleFiles

Language:
English

Digital Signature
Signed by:
New Monte Inc

Authority:
DigiCert Inc

Valid from:
12/1/2013 7:00:00 PM

Valid to:
12/6/2016 7:00:00 AM

Subject:
CN=New Monte Inc, O=New Monte Inc, L=Mahe, S=Seychelles, C=SC

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EF12F8AD3F2DFB7CD5C8F46FEE59C5C

File PE Metadata
Compilation timestamp:
1/23/2015 5:58:06 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:yySORPRfqFy8afRoLMWobJok8j+wvK5LvJaMKZOwnC+Q6WO:yfOEyReLKJor+wgJaM+3nG6WO

Entry address:
0x46A0AD

Entry point:
0F, 82, 84, 71, FE, FF, 68, 6B, 95, E9, 8D, 60, 8D, 64, 24, 20, 0F, 8C, 62, 66, 07, 00, 54, 53, C7, 44, 24, 04, DF, 35, 99, E5, 66, C7, 04, 24, 18, B4, 8D, 64, 24, 04, E9, B8, 7C, 38, 00, 62, 81, 8F, E4, A6, 35, 32, 68, 5C, 5E, A6, D9, 7A, F3, 4A, F7, 53, 54, 86, A5, C5, 7A, 00, E3, 27, CC, 7E, FD, AD, 42, 3E, A9, 71, AE, 16, 21, DE, 09, 41, 7E, FE, CA, 91, 8C, CC, 98, B4, A4, BC, 6C, DE, E1, 83, C7, 88, 65, 6E, 00, CF, AE, A2, 03, 86, 72, 31, E7, BB, 6D, 23, 1C, 20, AA, E5, 98, 2A, BF, C0, 68, E2, 27, FB...
 
[+]

Entropy:
7.9349  (probably packed)

Code size:
972 KB (995,328 bytes)

Windows Firewall Allowed Program
Name:
simplefiles


The file tome_of_ultimate_mapping_downloader.exe has been seen being distributed by the following URL.

http://dlr8847.simple-files.info/j5GRWG/V4lRgn5hTftG8InrZ/gpzsKkieKP7O2n10Gcs/tRmEePfbQCnmD1DvMxSHuzBUQTR3xtXlokBX5peGlrRNlE2gmgdIJ1uID6BYeZzxDPkPml64Gs1O/s e377MX9RqhZ4TPoCZ0P6HjZSzAM6QcMBf1rEA0pJ3QMVAvJYXiDW7m8q1 9XJuDkV2zzqEgxtM0pKfakcHP rnlP5qtiV OSdhy6 TwMrMJlRNuXaReDgFNA3I5VTY6JDeDDiw 3kaFFuMP3R7qd Uu3dq9B1k/07P42s q7bLv8nCf4/.../LRGsOViB7AgskSm46qVoeR91JmgagCY4D4Cj3d5iE82Ox2KqLtKCGm7y57 NJqKfTDJ02inWYV5NxmEg==

Remove tome_of_ultimate_mapping_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.