home

windows_8.1_activator_en_x86_x64_bit_downloader.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application windows_8.1_activator_en_x86_x64_bit_downloader.exe by Righway Technologies, Inc has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 464

MD5:
4bb1942079bb4263f33833870a5a81b6

SHA-1:
a3eaa521835bab98e72c28b86754e4df42bb15a4

SHA-256:
55e7deb4da3d67693092f18903fb645b0c326050735f9eabb9334058fab7793e

Scanner detections:
21 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 8:00:57 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.426646
516

Agnitum Outpost
Riskware.Agent
7.1.1

avast!
Win32:Adware-gen [Adw]
2014.9-150802

AVG
Righway Technologies
2016.0.3029

Bitdefender
Gen:Variant.Adware.Kazy.426646
1.0.20.1250

Clam AntiVirus
Win.Adware.Agent-8309
0.98/21411

Dr.Web
Adware.Downware.4798
9.0.1.0214

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.426646
8.15.09.07.07

ESET NOD32
Win32/ExpressDownloader.H potentially unwanted application
9.7.0.302.0

F-Secure
Gen:Variant.Adware.Kazy.426646
11.2015-07-09_2

G Data
Win32.Application.ExpressDownloader
15.8.24

herdProtect (fuzzy)
variant of install76587515.exe (Adware)
2015.9.7.7

IKARUS anti.virus
PUA.Expressdownloader
t3scan.1.7.8.0

K7 AntiVirus
Unwanted-Program
13.183.13642

Malwarebytes
PUP.Optional.GoForFiles.A
v2015.08.02.01

MicroWorld eScan
Gen:Variant.Adware.Kazy.426646
16.0.0.750

NANO AntiVirus
Trojan.Win32.Generic.dejkoc
0.28.2.62483

Reason Heuristics
PUP.Via Advertising.RighwayTechnologies.Bundler (M)
15.8.2.13

Sophos
Go For Files
4.98

VIPRE Antivirus
Threat.4925438
31208

Zillya! Antivirus
Trojan.Black.Win32.17432
2.0.0.1949

File size:
7.4 MB (7,781,288 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
8/6/2014 6:25:18 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
196608:hM6G2Z4raDWj6jD0rBfPg8d55riRJ4jTYB66yTgJS:hM6lWj6ihX5WRbBFyKS

Entry address:
0x3D50F

Entry point:
E8, A0, EF, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 50, F5, 46, 00, E8, 2B, 78, 00, 00, E8, C2, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, 33, EF, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 79, B5, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.9346  (probably packed)

Code size:
359.5 KB (368,128 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.