{"id":3411,"date":"2014-12-04T08:20:04","date_gmt":"2014-12-04T08:20:04","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=3411"},"modified":"2018-05-29T12:01:16","modified_gmt":"2018-05-29T12:01:16","slug":"tal%d1%96-grup-llc-20-detection-rate-tali-is-detected-as-amonetize-and-strictor","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/tal%d1%96-grup-llc-20-detection-rate-tali-is-detected-as-amonetize-and-strictor\/","title":{"rendered":"TAL\u0406 GRUP LLC – 20% Detection Rate – TALI is detected as Amonetize and Strictor"},"content":{"rendered":"

Welcome! If you’ve been following my recent posts here on the FreeFixer blog, you know that I’ve been looking at files that have a valid digital signature and bundle various types of potentially unwanted programs. A few days ago I found another publisher named TALI GRUP LLC<\/strong>.<\/p>\n

This is how TALI GRUP LLC appears when running the file:<\/p>\n

\"TALI<\/a><\/p>\n

You can also look at the TALI GRUP LLC certificate and digital signature by looking under the Digital Signatures tab on the file’s properties. According to the certificate,\u00a0TAL\u0406\u00a0GRUP LLC is located in Ukraine in the city of Kiev. The certificate is brand new.<\/p>\n

\"TALI<\/a><\/p>\n

The problem is that FlashPlayer__6741_i1416407838_il113.exe is not an official Flash Player download. If it was, it should be digitally signed by Adobe Systems Incorporated<\/strong>.<\/p>\n

So, why am I writing about the\u00a0TAL\u0406\u00a0GRUP LLC file? Check out what the antimalware programs report about the file:<\/p>\n

AhnLab-V3 detects FlashPlayer__6741_i1416407838_il113.exe as PUP\/Win32.Amonetiz<\/strong>, BitDefender detects it as Gen:Variant.Adware.Strictor.68509<\/strong> and Malwarebytes classifies it as PUP.Optional.Amonetize<\/strong> are a few of the detection names for FlashPlayer__6741_i1416407838_il113.exe.<\/p>\n

\"TALI<\/a><\/p>\n

To see more in details what changes the\u00a0TAL\u0406\u00a0GRUP LLC file would do on a user’s computer I decided to run the file on my lab machine. The installer bundled some additional software such as Wajam, VuuPC, Salus<\/a> and My Start Search. Here’s a screenshot from the installer:<\/p>\n

\"TALI<\/a><\/p>\n

Did you also find a file signed by\u00a0TAL\u0406\u00a0GRUP LLC? What kind of download was it and where did you find it?<\/p>\n

Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome! If you’ve been following my recent posts here on the FreeFixer blog, you know that I’ve been looking at files that have a valid digital signature and bundle various types of potentially unwanted programs. A few days ago I found another publisher named TALI GRUP LLC. This is how TALI GRUP LLC appears when … Continue reading TAL\u0406 GRUP LLC – 20% Detection Rate – TALI is detected as Amonetize and Strictor<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,54],"tags":[126,304,306,305],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3411"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=3411"}],"version-history":[{"count":1,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3411\/revisions"}],"predecessor-version":[{"id":3416,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3411\/revisions\/3416"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=3411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=3411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=3411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}