windows_7_rog_rampage_verified.exe

CoolMirage Ltd.

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application windows_7_rog_rampage_verified.exe by CoolMirage has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from www.torntv-dl.com and multiple other hosts.
Remove windows_7_rog_rampage_verified.exe - Powered by Reason Core Security
Publisher:
CoolMirage Ltd.  (signed and verified)

MD5:
bca498b1508c2b4276bf9ea1989ef762

SHA-1:
d5eced6158ba744d21ac604c20239d8b1583cf48

SHA-256:
23014ecb3a092680d55527b9e27e390821c47b2862523d6499944cab6edfab34

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
12/7/2016 11:22:59 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.1263
9.0.1.0161

Kingsoft AntiVirus
Win32.Troj.Generic.a.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.OneClickDownloader.A
v2014.06.10.10

McAfee
Artemis!BCA498B1508C
5600.7104

McAfee Web Gateway
Artemis!BCA498B1508C
7.7104

NANO AntiVirus
Riskware.Nsis.Downware.czyjkl
0.28.0.60253

Panda Antivirus
PUP/MultiToolbar.A
14.06.10.10

Qihoo 360 Security
Win32/Virus.Adware.47b
1.0.0.1015

Reason Heuristics
PUP.CoolMirage.EE
14.8.7.17

Trend Micro House Call
TROJ_GEN.F47V0609
7.2.161

VIPRE Antivirus
BubbleDock
30152

Remove windows_7_rog_rampage_verified.exe - Powered by Reason Core Security
File size:
423.9 KB (434,040 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\windows_7_rog_rampage_verified.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
5/4/2014 2:00:00 AM

Valid to:
6/7/2015 1:59:59 AM

Subject:
CN=CoolMirage Ltd., O=CoolMirage Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2B95F61752266B15878ADF48E717C64B

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:nsA7cQsmKZGrIKVFdbiq76qzYgUKmaC0QJUHGeanFWa3/jvU3ZNuxMBvZg5:hcQsmKZiIKVDiAbzXhfQmH8x/YZ0MBq5

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file windows_7_rog_rampage_verified.exe has been seen being distributed by the following 2 URLs.

Remove windows_7_rog_rampage_verified.exe - Powered by Reason Core Security