trtextsetup.exe

CoolMirage Ltd.

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application trtextsetup.exe by CoolMirage has been detected as adware by 3 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. It is also typically executed from the user's temporary directory.
Remove trtextsetup.exe - Powered by Reason Core Security
Publisher:
Yoroueufsc  (signed by CoolMirage Ltd.)

Description:
Dyjgorhusmtan

Version:
25.22.19.25

MD5:
24b1a5baec3e2e697a7b3bdb6023c487

SHA-1:
09c4f76d3289d9091f87c8ebb8f0ceede0c80eb2

SHA-256:
67f1090d0b15df2b8f38a7de47e4084ea9941eb1b448cdf3aeee76e3660017cd

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
12/3/2016 1:30:30 AM UTC  (today)

Scan engine
Detection
Engine version

Panda Antivirus
PUP/MultiToolbar.A
14.06.10.11

Reason Heuristics
PUP.Installer.CoolMirage.L
14.8.7.17

VIPRE Antivirus
Threat.4783938
30086

Remove trtextsetup.exe - Powered by Reason Core Security
File size:
8.5 MB (8,888,192 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\trtextsetup.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
6/5/2013 8:00:00 PM

Valid to:
6/6/2014 7:59:59 PM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
110F603E63C86349A5F243EA06966F33

File PE Metadata
Compilation timestamp:
12/4/2012 8:55:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
196608:abfht1wmfqvIZ7N+zt/iPc8iOC2akXYyNisQ5f/j6wFGm1brC:aNrJbQxxxLmg/j6lEu

Entry address:
0x4323

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, C3, 44, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, C4, 44, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, C4, 44, 00, 56, A3, 40, 3B, 44, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 3B, 44, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, C4, 44, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.9987  (probably packed)

Code size:
34.5 KB (35,328 bytes)

Remove trtextsetup.exe - Powered by Reason Core Security