home

cccam_soft.txt_downloader.exe

YourFile Downloader

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application cccam_soft.txt_downloader.exe by Via Advertising Group Limited has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.
Publisher:
http://yourfiledownloader.com  (signed by Via Advertising Group Limited)

Product:
YourFile Downloader

Version:
1, 0, 0, 293

MD5:
6ec56d83f8f6559799920b751835c334

SHA-1:
15e21de1cf85e28fe5f9a7f323a8918c27193b50

SHA-256:
806ac670489338916b45f05c516a406ff1b7d1184e75d81b50fec7b53e90198c

Scanner detections:
23 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 3:57:45 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Kazy.133001
6435848

AhnLab V3 Security
Win-PUP/YourFileDownloader
2015.02.09

Avira AntiVirus
Adware/Babylon.E
7.11.208.184

avast!
Win32:Downloader-UEO [PUP]
150129-1

AVG
Adware BundleApp.EG
2014.0.4253

Bitdefender
Gen:Variant.Application.Kazy.133001
1.0.20.195

Dr.Web
Adware.Downware.5658
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Kazy.133001
9.0.0.4799

ESET NOD32
Win32/ExpressDownloader.I potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Generic.AC.2244355
2/8/2015

F-Secure
Riskware.Gen:Variant.Application.Kazy
5.13.68

G Data
Gen:Variant.Application.Kazy.133001
15.2.25

IKARUS anti.virus
AdWare.Babylon
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.193.14899

Malwarebytes
PUP.Optional.YourFileDownloader
v2015.02.08.12

Microsoft Security Essentials
Threat.Undefined
1.191.4348.0

MicroWorld eScan
Gen:Variant.Application.Kazy.133001
16.0.0.117

NANO AntiVirus
Riskware.Win32.Babylon.dffshm
0.30.0.65070

Norman
Gen:Variant.Application.Kazy.133001
02.01.2015 13:58:24

Reason Heuristics
PUP.Via Advertising
15.2.8.11

Sophos
PUA 'YourFile Downloader' (of type Adware)
5.10

VIPRE Antivirus
Threat.4758264
37240

Zillya! Antivirus
Trojan.Black.Win32.17420
2.0.0.2057

File size:
6.1 MB (6,346,248 bytes)

Product version:
1.0.0

Copyright:
Copyright http://yourfiledownloader.com (C) 2012

Original file name:
YourFile.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\cccam_soft.txt_downloader.exe

Digital Signature
Signed by:
Via Advertising Group Limited

Authority:
COMODO CA Limited

Valid from:
4/12/2013 12:00:00 AM

Valid to:
4/11/2016 11:59:59 PM

Subject:
CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BABC309174F531C6762BBA466401FEAF

File PE Metadata
Compilation timestamp:
5/27/2014 5:17:30 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:bmqSGz8F0k6m20qXF3HnBdOt9E42n8l+3J4jfbYtMNLwUBfJv:bmqvz20pLY9zvg3J4jTYmyUZp

Entry address:
0x3F947

Entry point:
E8, 58, F0, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 48, 3A, 47, 00, E8, A3, 77, 00, 00, E8, 3A, 29, 00, 00, 0F, B7, F0, 6A, 02, E8, EB, EF, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, F2, B4, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
370.5 KB (379,392 bytes)

The file cccam_soft.txt_downloader.exe has been seen being distributed by the following URL.

http://i.yourfiledownloader.com/j5GmVGHRpBB126tLJMypNyjIpnoj9Ol6LvfkeSr6xyBrrpI6S7TUahbs2WYMq4QBR7jIVgLYzVIQlJwdToZkAWGFYUp21n4WL5AwTn/PN/c3jHC6dHRr6jBidOwFfFjjOzEcsQF8QPgNKRy5H3kM4CY6WcBPRkuNAEVRxh53NdoTSXiGtgB4g7QAdI 4HiWq41lo9qZwaPOkcGT/qG4RofEoELTWDwC/m2ZLq5cwV5feMEiPlAsckotUToyDCbXF3F62zvZHvp30Fu7I/.../8eojPksaE5sw==

Remove cccam_soft.txt_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.