{"id":3190,"date":"2014-11-27T09:31:47","date_gmt":"2014-11-27T09:31:47","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=3190"},"modified":"2018-05-29T12:01:47","modified_gmt":"2018-05-29T12:01:47","slug":"coolmirage-ltd-defaulttab-oneclickdownloader-multitoolbar","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/coolmirage-ltd-defaulttab-oneclickdownloader-multitoolbar\/","title":{"rendered":"CoolMirage Ltd. – 28 % Detection Rate – DefaultTab \/ OneClickDownloader \/ MultiToolbar"},"content":{"rendered":"

Hello! Here’s a short blog post from a foggy Stockholm. If you’ve been following me for the last year you know that I’ve been examining many software publishers that put a digital signature on their downloads. Today I found another publisher called CoolMirage Ltd.\u00a0<\/strong>which appears to have been around for some time.<\/p>\n

\"CoolMirage<\/a><\/p>\n

 <\/p>\n

The file is named in a way which can make some users think they are downloading a movie, rather than an executable file.<\/p>\n

Typically you’d see the CoolMirage Ltd. publisher name appear when double-clicking on the downloaded\u00a0file: Viewing the certificate information is also possible by looking under the digital signature tab for the file. Here the certificate says that CoolMirage Ltd. is located in Tel Aviv, Israel.<\/p>\n

\"The<\/a><\/p>\n

The issue with the CoolMirage Ltd. file is that it is detected by many of the anti-malware scanners. Here are some of the detection names: Gen:Application.Bundler.DefaultTab.1, PUP.Optional.OneClickDownloader.A, Adware-SweetIM, PUP\/MultiToolbar.A and CoolMirage.<\/p>\n

\"CoolMirage<\/a><\/p>\n

Did you also find a CoolMirage Ltd. file? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal to see if that one is also detected.<\/p>\n

Thanks for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hello! Here’s a short blog post from a foggy Stockholm. If you’ve been following me for the last year you know that I’ve been examining many software publishers that put a digital signature on their downloads. Today I found another publisher called CoolMirage Ltd.\u00a0which appears to have been around for some time.   The file … Continue reading CoolMirage Ltd. – 28 % Detection Rate – DefaultTab \/ OneClickDownloader \/ MultiToolbar<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[253,252,256,254,255,251],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3190"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=3190"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3190\/revisions"}],"predecessor-version":[{"id":3195,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3190\/revisions\/3195"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=3190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=3190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=3190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}