home

bestvideodownloader.exe

KBM2 Installer

sterkly LLC

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application bestvideodownloader.exe by sterkly has been detected as adware by 16 anti-malware scanners. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.
Publisher:
sterkly LLC  (signed and verified)

Product:
KBM2 Installer

Version:
2.5.1.0

MD5:
b440c650863f8918dbd62c2b9db05989

SHA-1:
f73d5b67244a64fead79cbb628db87407f3bf60e

SHA-256:
10a1c1161b169b162777c14e8a102a3a3c9e93576fd87dcf2e02e381e9910538

Scanner detections:
16 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Analysis date:
4/26/2024 4:21:22 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
AdInject.Sterkly
2016.0.3141

Baidu Antivirus
PUA.Win32.KBM
4.0.3.15413

Dr.Web
Adware.Plugin.85
9.0.1.0103

Emsisoft Anti-Malware
Trojan.Win32.KBM.AMN
8.15.04.13.09

ESET NOD32
Win32/KBM (variant)
9.8551

Fortinet FortiGate
Riskware/MultiPlug
4/13/2015

F-Prot
W32/Adware.AKRY
v6.4.7.1.166

herdProtect (fuzzy)
variant of oneclickroot.exe (Adware)
2015.7.15.8

IKARUS anti.virus
PUA.KBM
t3scan.1.8.3.0

Malwarebytes
PUP.Optional.BundleInstaller.A
v2015.04.13.09

McAfee
Artemis!B440C650863F
5600.6797

NANO AntiVirus
Riskware.Win32.Plugin.cxiows
0.28.6.63474

Reason Heuristics
PUP.Installer.Yontoo
15.4.13.5

Trend Micro House Call
TROJ_GEN.F47V0625
7.2.103

VIPRE Antivirus
sterkly LLC
19476

File size:
544.1 KB (557,176 bytes)

Product version:
2.5.1.0

Copyright:
(c) Sterkly LLC. All rights reserved.

Original file name:
KBM2.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\bestvideodownloader.exe

Digital Signature
Signed by:
sterkly LLC

Authority:
VeriSign, Inc.

Valid from:
1/22/2013 1:00:00 AM

Valid to:
2/22/2015 12:59:59 AM

Subject:
CN=sterkly LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=sterkly LLC, L=Carlsbad, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
113C6B2C72DEF110BE64B2ABBC52861E

File PE Metadata
Compilation timestamp:
6/20/2013 9:46:31 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:hTq6uX5c0RzWguzZylIAllGVytvHdKme7IZhpYiQ26:h2610ZluglqytYmesZhhQf

Entry address:
0x3A3C0

Entry point:
E8, 0E, 6F, 00, 00, E9, 89, FE, FF, FF, 3B, 0D, D0, 0B, 47, 00, 75, 02, F3, C3, E9, 95, 6F, 00, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 85, F6, 75, 04, 33, C0, EB, 61, 83, 7D, 08, 00, 75, 13, E8, D9, 35, 00, 00, 6A, 16, 5E, 89, 30, E8, 6C, 75, 00, 00, 8B, C6, EB, 48, 83, 7D, 10, 00, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, 66, 70, 00, 00, 83, C4, 0C, EB, C7, FF, 75, 0C, 6A, 00, FF, 75, 08, E8, B4, 31, 00, 00, 83, C4, 0C, 83, 7D, 10, 00, 74, BB, 39, 75, 0C, 73, 0E, E8, 8F, 35, 00, 00, 6A...
 
[+]

Entropy:
6.2272

Code size:
342.5 KB (350,720 bytes)

Remove bestvideodownloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.