home

.9011.doc__2299_i417572944_il8993030.exe

Install

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application .9011.doc__2299_i417572944_il8993030.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Shetef Solutions & Consulting (1998) Ltd.  (signed and verified)

Product:
Install

Version:
1.1.6.19

MD5:
e92bde0ec82678061e53462b232ce105

SHA-1:
6e2c64442d4a0fd5cf85970642817357b93c2a0a

SHA-256:
577ebf86c2ff54e51c48d6c3b686363fbd4dce37d2c567167107476fbe293eca

Scanner detections:
11 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/18/2024 4:04:50 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.03.09

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.135.168

avast!
Win32:Amonetize-M [PUP]
2014.9-140308

AVG
Generic_r
2015.0.3541

Dr.Web
Adware.Downware.1575
9.0.1.067

ESET NOD32
Win32/Amonetize.AG (variant)
8.9517

Fortinet FortiGate
Riskware/Amonetize
3/8/2014

Malwarebytes
PUP.Optional.Amonetize.A
v2014.03.08.03

McAfee
Artemis!E92BDE0EC826
5600.7197

Trend Micro House Call
TROJ_GEN.F47V0306
7.2.67

VIPRE Antivirus
Trojan.Win32.Generic
27202

File size:
149.1 KB (152,704 bytes)

Product version:
2.1.12

Copyright:
Copyright( c ) All Rights Reserved.

Original file name:
Install.exe

File type:
Executable application (Win64 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\.9011.doc__2299_i417572944_il8993030.exe

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Serial number:
7C23DBB97FAFBB9D28D413F836202024

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
3072:B0z7/XzTEFgbXKjcpAXARgwT92Gls/MMT3zqNsHnD:BqzXzIFgbJeXDwBLlyTosHD

Entry point:
60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.7909

Packer / compiler:
UPX 2.90LZMA

The file .9011.doc__2299_i417572944_il8993030.exe has been seen being distributed by the following 10 URLs.

http://ad.propellerads.com/ck.php?oaparams=2__bannerid=95328__zoneid=20435__OXLCA=1__cb=178c664651__oadest=http://.../?id=p191&sub=ar&name=File.Download&nor=1&subid=${SUBID}

http://www.extractdownload.com/download.php?version=1.1.6.19&campid=2299&instid[appsetupurl]=&instid[appname]=Download.The.Walking.Dead.S04E05.HDTV.x264.2HD.eztv.Torrent.KickassTorrents&instid[appimageurl]=http://.../dl.png&prefix=Download.The.Walking.Dead.S04E05.HDTV.x264.2HD.eztv.Torrent.KickassTorrents&ti1=t198.0.0.1.37b56e4b00&ti2=IfiiBdErV3Nn1zO98dxc-c7ADI_QVHIIwZ1Dy8HbDGrI

http://dl-gate.net/?id=t198&subid=IfiiBdErV3Nn1zO98dxc-c7ADI_QVHIIwZ1Dy8HbDGrI&name=Download The Walking Dead S04E05 HDTV x264-2HD [eztv] Torrent - KickassTorrents

http://www.extractdownload.com/download.php?version=1.1.6.19&campid=2299&instid[appsetupurl]=&instid[appname]=Bar.Rescue.Seasons.1.3.download.torrent.TPB&instid[appimageurl]=http://.../dl.png&prefix=Bar.Rescue.Seasons.1.3.download.torrent.TPB&ti1=t198.0.0.1.37c034c222&ti2=IfiiBdErV3Nn1zO98dxc-c7ADI_QVHIIwZ1Dy8HbDGrI

http://dl-gate.net/?id=t198&subid=IfiiBdErV3Nn1zO98dxc-c7ADI_QVHIIwZ1Dy8HbDGrI&name=Bar Rescue Seasons 1-3 (download torrent) - TPB

http://www.extractdownload.com/download.php?version=1.1.6.19&campid=2299&instid[appsetupurl]=&instid[appname]=Download.Dishonored.Full.Unlocked.PC.version.Torrent.KickassTorrents&instid[appimageurl]=http://.../dl.png&prefix=Download.Dishonored.Full.Unlocked.PC.version.Torrent.KickassTorrents&ti1=t198.0.0.1.37a76bf506&ti2=IfKqUI1jzQlczpbXM09rh9WMhtd8KmE4GOJE60UznPR7

http://dl-gate.net/?id=t198&subid=IfKqUI1jzQlczpbXM09rh9WMhtd8KmE4GOJE60UznPR7&name=Download Dishonored Full Unlocked PC version Torrent - KickassTorrents

http://www.extractdownload.com/download.php?version=1.1.6.19&campid=2299&instid[appsetupurl]=&instid[appname]=EZTV.Proxy.TV.Torrents.Online.Hosted.by.eztv.proxy.net&instid[appimageurl]=http://.../dl.png&prefix=EZTV.Proxy.TV.Torrents.Online.Hosted.by.eztv.proxy.net&ti1=t198.0.0.1.375bd38e16&ti2=IQqX4VP1I6nuGDRDzWAGDCc0_NyKNagKzAJ6wvk5lYTd

http://www.extractdownload.com/download.php?version=1.1.6.19&campid=2299&instid[appsetupurl]=&instid[appname]=EZTV.Proxy.TV.Torrents.Online.Hosted.by.eztv.proxy.net&instid[appimageurl]=http://.../dl.png&prefix=EZTV.Proxy.TV.Torrents.Online.Hosted.by.eztv.proxy.net&ti1=t198.0.0.1.3729695d16&ti2=IQqX4VP1I6nuGDRDzWAGDCc0_NyKNagKzAJ6wvk5lYTd

http://dl-gate.net/?id=t198&subid=IQqX4VP1I6nuGDRDzWAGDCc0_NyKNagKzAJ6wvk5lYTd&name=EZTV Proxy - TV Torrents Online - Hosted by eztv-proxy.net

Remove .9011.doc__2299_i417572944_il8993030.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.