» update260121562.exe
Overview
Analysis
File Details
Programs (1)

update260121562.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application update260121562.exe by Righway Technologies, Inc has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This file is typically installed with the program GoforFiles by Righway Technologies, Inc which is a potentially unwanted software program.

File name:

update260121562.exe

Publisher:

http://www.goforfiles.com/ (signed by Righway Technologies, Inc)

Product:

GoforFiles

Version:

1, 0, 0, 464

MD5:

e9740b52043bf445b06d73934150c9c6

SHA-1:

6a95a60b51449f1eccb3e3a2a7ca077915755834

SHA-256:

45f878862d6d20371428e0c8f799b42802cd8dc6f758aa6589d9cb586651360c

Scanner detections:

6 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

5/3/2024 12:11:50 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Skodna.Generic_r

2015.0.3603

ESET NOD32

Win32/YourFileDownloader (variant)

8.8355

herdProtect (fuzzy)

variant of uninstall24195411.exe (Adware)

2014.1.5.17

Reason Heuristics

PUP.RighwayTechnologies.P

14.8.7.21

Sophos

Go For Files

4.89

VIPRE Antivirus

Yontoo

17960

File size:

6.1 MB (6,438,536 bytes)

Product version:

2,0,0,0

Original file name:

GoforFiles.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

YourFile Downloader

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\update260121562.exe

Digital Signature

Signed by:

Righway Technologies, Inc

Authority:

COMODO CA Limited

Valid from:

8/22/2012 1:00:00 AM

Valid to:

8/23/2015 12:59:59 AM

Subject:

CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

0089B8C147F063769F8D685962C161E027

File PE Metadata

Compilation timestamp:

4/1/2013 4:39:41 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

196608:QR0whBjGZxJ4jTYx98cxxh0zRV4Y+ETO2:QR0qQZxbx9Zxr0bE2

Entry address:

0xDDAD

Entry point:

E8, C3, 6B, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, 84, A7, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 47, 08, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 40... 
[+]

Code size:

109 KB (111,616 bytes)

The file update260121562.exe has been discovered within the following program.

GoforFiles by Righway Technologies, Inc

GoforFiles bundles various adware toolbars including the Delta Search Toolbar (an adware toolbar that modifies the user's web browser home page, search settings and other settings).

www.goforfiles.com

70% remove it

Remove update260121562.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.