Your File Is Ready To Download_740968.exe threat report

MD5 a3e6eae5fbdc1875e49c6c84d941812f
Latest seen 2021-05-09 20:11:37 (4 years ago)
First seen 2021-02-19 04:55:39 (5 years ago)
Size 2 MB

This report summarizes the file identity, detection status, publisher metadata, observed locations, and technical indicators for Your File Is Ready To Download_740968.exe. ThreatInfo currently classifies this sample as Adware.SpecialSearchOffer.

GridinSoft Anti-Malware detection

GridinSoft already detects this file

The latest ThreatInfo record shows Your File Is Ready To Download_740968.exe detected as Adware.SpecialSearchOffer. You can download GridinSoft Anti-Malware to scan the system and remove this detection if the file is present on your device.

Detection name
Adware.SpecialSearchOffer
Last analysis
2021-05-09 20:11:37 (4 years ago)
File hash
a3e6eae5fbdc1875e49c6c84d941812f
Download Anti-Malware

Your File Is Ready To Download_740968.exe is a Windows file recorded in the ThreatInfo database. It is associated with TradescantiaInstallSoft. The reported company name is Tradescantia Company. The current detection status is Adware.SpecialSearchOffer, based on the latest analysis from 2021-05-09 20:11:37 (4 years ago).

If Your File Is Ready To Download_740968.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Adware.SpecialSearchOffer.

Product Name: TradescantiaInstallSoft
Company Name: Tradescantia Company
MD5: a3e6eae5fbdc1875e49c6c84d941812f
Size: 2 MB
First Published: 2021-02-19 04:55:39 (5 years ago)
Latest Published: 2021-05-09 20:11:37 (4 years ago)
Status: Adware.SpecialSearchOffer (on last analysis)
Analysis Date: 2021-05-09 20:11:37 (4 years ago)
Your File Is Ready To Download_740968.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Signed By: Zeus Softwares Limited
Status: Valid

The signature on Your File Is Ready To Download_740968.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

%profile%
%profile%
%sysdrive%

ThreatInfo has observed Your File Is Ready To Download_740968.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

66.7%
33.3%

The strongest geographic signal for this file is Peru with 66.7% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for Your File Is Ready To Download_740968.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Your File Is Ready To Download_740968.exe is identified as pe for 32 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 32
Image Base: 0x00400000
Entry Address: 0x00100f36

PE Sections:

Name Size of data MD5
.text 1517568 01e23ad99376de08cb05d0f93ea9dbc9
.tujo 2560 9bae754acbdbf714df7617536687faf3
.uko 1536 899226435c7040d7aeba3961efa24e91
.tuz 2048 5091053a37c9fbdd70b2a594f6b7f133
.tui 2048 b7e89751d8ac4933a4e62a386ea86914
.tok 4608 321f506093a804b26e3ab0610b9b42ac
.taf 5632 ac815f27630786d49b856d86384b6c7d
.rdata 365568 54169ee56ade2b1aeb7e36ba70376853
.data 23552 340ebfdf720c3989617f4a02b87a8874
.rsrc 155648 e0c4ed5be700fe15e3773574c2728b8a
.reloc 155136 a4b42219ad1514f3db47e892b2417c40

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: