home

utorrent-3-3-build-29677-es-en-br-fr-de-it-cn-jp-ar-ru-win.exe

Visual Tools

The application utorrent-3-3-build-29677-es-en-br-fr-de-it-cn-jp-ar-ru-win.exe by Visual Tools has been detected as adware by 6 anti-malware scanners. This is a setup program which is used to install the application. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. The file has been seen being downloaded from dw2.uptodown.com.
Publisher:
Visual Tools  (signed and verified)

MD5:
54391ad753524e1aa58c654525ac9230

SHA-1:
d88a36a1a5d9312503c8ebda8347ecbf5f03833a

SHA-256:
290ca9f03681252d72fb90c2767d743f8b5c797a06911c96664d5ddef6c65620

Scanner detections:
6 / 68

Status:
Adware

Analysis date:
4/18/2024 11:42:18 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Toolbar.175
9.0.1.0339

ESET NOD32
Win32/Toolbar.Babylon (variant)
9.9822

Malwarebytes
PUP.Optional.Babylon
v2015.12.05.03

McAfee
Artemis!54391AD75352
5600.6560

Reason Heuristics
PUP.Babylon.Banylon (M)
15.12.5.15

VIPRE Antivirus
Babylon
29408

File size:
772.1 KB (790,608 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\utorrent-3-3-build-29677-es-en-br-fr-de-it-cn-jp-ar-ru-win.exe

Digital Signature
Signed by:
Visual Tools

Authority:
Thawte, Inc.

Valid from:
1/10/2013 1:00:00 AM

Valid to:
1/11/2015 12:59:59 AM

Subject:
CN=Visual Tools, O=Visual Tools, L=Belgrade, S=Serbia, C=RS

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
789958B0264F06055619270074AFA61F

File PE Metadata
Compilation timestamp:
3/13/2013 12:56:02 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:awiGTpTLDxxwqQcqOj5eyHox6ZGmAuXE7z:DbVvwqQpoLHontD3

Entry address:
0x15A7

Entry point:
55, 8D, AC, 24, 40, F6, FF, FF, 81, EC, 3C, 0A, 00, 00, A1, 00, 50, 40, 00, 33, C5, 89, 85, BC, 09, 00, 00, 53, 56, 33, DB, 57, 8D, 75, 88, 88, 5D, 87, C6, 45, 86, 01, E8, AD, 05, 00, 00, 53, 89, 9D, DC, 01, 00, 00, 89, 9D, E0, 01, 00, 00, 89, 9D, E4, 01, 00, 00, C7, 85, E8, 01, 00, 00, 03, 00, 00, 00, FF, 55, C4, 89, 85, D8, 01, 00, 00, 8B, C6, E8, FD, F9, FF, FF, 3B, C3, 0F, 85, 0A, 01, 00, 00, 8D, 85, EC, 01, 00, 00, 50, 8B, FE, E8, 35, FF, FF, FF, 8B, F8, 3B, FB, 0F, 85, C0, 00, 00, 00, 33, FF, 66, 39...
 
[+]

Code size:
11.5 KB (11,776 bytes)

The file utorrent-3-3-build-29677-es-en-br-fr-de-it-cn-jp-ar-ru-win.exe has been seen being distributed by the following URL.

http://dw2.uptodown.com/dm/3/1374526372/.../utorrent-3-3-build-29677-es-en-br-fr-de-it-cn-jp-ar-ru-win-setup.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.