home

bestvideodownloader.exe

KBM2 Installer

sterkly LLC

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application bestvideodownloader.exe by sterkly has been detected as adware by 16 anti-malware scanners. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.
Publisher:
sterkly LLC  (signed and verified)

Product:
KBM2 Installer

Version:
2.5.1.0

MD5:
a98365b65344317ed565d88e179c6e1a

SHA-1:
3ddf50778776b750fe0b8cb245dfbbfb63d7b490

SHA-256:
c0052281107c0f2bb77a354ca6d1ceaab7b26892f035718bec7d210ba2f756bd

Scanner detections:
16 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Analysis date:
4/24/2024 2:56:03 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
AdInject.Sterkly
2016.0.3145

Baidu Antivirus
Trojan.Win32.KBM
4.0.3.1549

Dr.Web
Adware.Plugin.85
9.0.1.099

Emsisoft Anti-Malware
Trojan.Win32.KBM.AMN
8.15.04.09.01

ESET NOD32
Win32/KBM (variant)
9.10802

Fortinet FortiGate
Riskware/MultiPlug
4/9/2015

F-Prot
W32/Adware.AKRY
v6.4.7.1.166

herdProtect (fuzzy)
variant of oneclickroot.exe (Adware)
2015.7.12.2

IKARUS anti.virus
PUA.KBM
t3scan.1.8.3.0

Malwarebytes
PUP.Optional.BundleInstaller.A
v2015.04.09.01

McAfee
Artemis!49412EC74859
5600.6801

NANO AntiVirus
Riskware.Win32.Plugin.cxiows
0.28.6.63474

Reason Heuristics
PUP.Installer.Yontoo
15.4.8.21

Trend Micro House Call
Suspicious_GEN.F47V1110
7.2.99

VIPRE Antivirus
sterkly LLC
34998

File size:
544.1 KB (557,176 bytes)

Product version:
2.5.1.0

Copyright:
(c) Sterkly LLC. All rights reserved.

Original file name:
KBM2.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\bestvideodownloader.exe

Digital Signature
Signed by:
sterkly LLC

Authority:
VeriSign, Inc.

Valid from:
1/21/2013 6:00:00 PM

Valid to:
2/21/2015 5:59:59 PM

Subject:
CN=sterkly LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=sterkly LLC, L=Carlsbad, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
113C6B2C72DEF110BE64B2ABBC52861E

File PE Metadata
Compilation timestamp:
7/25/2013 12:15:04 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:+gq6uX5c0RzWguzZylIAllGVytvHdKme7IZ4pYtQ5b:+R610ZluglqytYmesZ4CQp

Entry address:
0x3A3C0

Entry point:
E8, 0E, 6F, 00, 00, E9, 89, FE, FF, FF, 3B, 0D, D0, 0B, 47, 00, 75, 02, F3, C3, E9, 95, 6F, 00, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 85, F6, 75, 04, 33, C0, EB, 61, 83, 7D, 08, 00, 75, 13, E8, D9, 35, 00, 00, 6A, 16, 5E, 89, 30, E8, 6C, 75, 00, 00, 8B, C6, EB, 48, 83, 7D, 10, 00, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, 66, 70, 00, 00, 83, C4, 0C, EB, C7, FF, 75, 0C, 6A, 00, FF, 75, 08, E8, B4, 31, 00, 00, 83, C4, 0C, 83, 7D, 10, 00, 74, BB, 39, 75, 0C, 73, 0E, E8, 8F, 35, 00, 00, 6A...
 
[+]

Entropy:
6.2273

Code size:
342.5 KB (350,720 bytes)

Remove bestvideodownloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.