home

TornTVApp.exe

TornTVApp

Kanchana Khiandee

The application TornTVApp.exe, “TornTV Application” by Kanchana Khiandee has been detected as adware by 15 anti-malware scanners. This is a setup program which is used to install the application. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cmpsmarter-downloader.maynemyltf.netdna-cdn.com.
Publisher:
TornTV.com  (signed by Kanchana Khiandee)

Product:
TornTVApp

Description:
TornTV Application

Version:
2.0.0.1

MD5:
6240ecb1e3ed7d19c791f8e6ab304f17

SHA-1:
b313b45d24656360d22b037532d05162a828a019

SHA-256:
6e4db7d4563e1b56e4c4bfeb1f8726dc497329afe2a2e7b67b5a58d14d7e333b

Scanner detections:
15 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
4/26/2024 2:35:09 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Yontoo
7.1.1

AVG
Generic
2015.0.3256

Dr.Web
Adware.Yontoo.25
9.0.1.0270

herdProtect (fuzzy)
variant of torntv.exe (Adware)
2014.12.8.22

IKARUS anti.virus
not-a-virus:AdWare.Yontoo
t3scan.1.8.5.0

Kaspersky
not-a-virus:AdWare.NSIS.Yontoo
14.0.0.2775

McAfee
Artemis!E876E34992E8
5600.6912

nProtect
Trojan-Clicker/W32.Agent.827648
14.12.11.01

Panda Antivirus
Generic Suspicious
14.12.19.01

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.KanchanaKhiandee.J
14.10.8.13

Trend Micro House Call
Suspicious_GEN.F47V1210
7.2.353

Vba32 AntiVirus
AdWare.Yontoo
3.12.26.3

VIPRE Antivirus
CoolMirage Ltd
35640

Zillya! Antivirus
Adware.Yontoo.Win32.51
2.0.0.2003

File size:
808.2 KB (827,632 bytes)

Product version:
2.0.0.1

Copyright:
(c) TornTV.com All rights reserved.

Original file name:
TornTVApp.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\torntvapp.exe

Digital Signature
Signed by:
Kanchana Khiandee

Authority:
Thawte, Inc.

Valid from:
9/8/2014 1:00:00 AM

Valid to:
9/9/2015 12:59:59 AM

Subject:
CN=Kanchana Khiandee, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
1C0F6CB32F77CACE96D7BF647840EEF4

File PE Metadata
Compilation timestamp:
4/7/2013 11:55:55 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:w10Q37SEEY8i3J7iFf6cH5B+5fbK3qvSmE+mPP7j8Iru9XL/by3Ch:wyYef66DaTK3q68aP74Irulv

Entry address:
0x20D21

Entry point:
E8, 63, 74, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63, FC, FF, E0, 5B, C9, C2, 08, 00, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 8B, FF, 55, 8B, EC, 51, 51, 53, 56, 57, 64, 8B, 35, 00, 00, 00, 00, 89, 75, FC, C7, 45, F8, 9D, 0D, 42, 00, 6A, 00, FF, 75, 0C, FF, 75, F8, FF, 75, 08, E8, 53, 05, 01, 00, 8B, 45, 0C, 8B...
 
[+]

Code size:
201.5 KB (206,336 bytes)

The file TornTVApp.exe has been seen being distributed by the following URL.

http://cmpsmarter-downloader.maynemyltf.netdna-cdn.com/TornTVApp.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to sage.parklogic.com  (69.39.236.56:80)

TCP (HTTP):
Connects to unknown.prolexic.com  (72.52.4.90:80)

TCP (HTTP):
Connects to a23-57-219-27.deploy.static.akamaitechnologies.com  (23.57.219.27:80)

TCP (HTTP):
Connects to 178-175-130-163.static.host  (178.175.130.163:80)

TCP (HTTP):
Connects to vip1.g5.cachefly.net  (180.149.246.128:80)

TCP (HTTP):
Connects to t-ams5.mplxtms.com  (63.215.202.72:80)

TCP (HTTP SSL):
Connects to sgsg02.proinity.net  (119.81.66.229:443)

TCP (HTTP):
Connects to ec2-52-76-6-48.ap-southeast-1.compute.amazonaws.com  (52.76.6.48:80)

TCP (HTTP SSL):
Connects to ec2-52-201-97-156.compute-1.amazonaws.com  (52.201.97.156:443)

TCP (HTTP):
Connects to a202-133-52-87.deploy.akamaitechnologies.com  (202.133.52.87:80)

TCP (HTTP):
Connects to a202-133-52-75.deploy.akamaitechnologies.com  (202.133.52.75:80)

TCP (HTTP):
Connects to 166.22.211.130.bc.googleusercontent.com  (130.211.22.166:80)

TCP (HTTP):
Connects to ns3013993.ip-149-202-76.eu  (149.202.76.60:80)

TCP (HTTP):
Connects to ec2-54-72-9-115.eu-west-1.compute.amazonaws.com  (54.72.9.115:80)

TCP (HTTP):
Connects to ec2-52-220-143-90.ap-southeast-1.compute.amazonaws.com  (52.220.143.90:80)

TCP (HTTP):
Connects to ec2-54-236-238-142.compute-1.amazonaws.com  (54.236.238.142:80)

TCP (HTTP):
Connects to ec2-54-206-87-167.ap-southeast-2.compute.amazonaws.com  (54.206.87.167:80)

TCP (HTTP SSL):
Connects to ec2-52-72-237-12.compute-1.amazonaws.com  (52.72.237.12:443)

TCP (HTTP SSL):
Connects to ec2-52-3-176-101.compute-1.amazonaws.com  (52.3.176.101:443)

TCP (HTTP):
Connects to ec2-52-24-203-21.us-west-2.compute.amazonaws.com  (52.24.203.21:80)

Remove TornTVApp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.