» chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe
Overview
Analysis
File Details
Downloads (14)
Network (3)

chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe

Installer

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.

File name:

Publisher:

Shetef Solutions & Consulting (1998) Ltd. (signed and verified)

Product:

Installer

Version:

1.1.5.98

MD5:

cb11e5706dbdca22bd53cb52b7b9a010

SHA-1:

38f362366a4c7d328d7941d9616f0cf6503239ae

SHA-256:

27ff1fe305a236db301e619bab78ca338a90f75125d66a45ea953aae429ecb82

Scanner detections:

11 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/23/2024 4:21:45 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.02.23

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.133.70

Dr.Web

Adware.Downware.1575

9.0.1.055

ESET NOD32

Win32/Amonetize.AG (variant)

8.9459

Fortinet FortiGate

Riskware/Amonetize

2/24/2014

G Data

Win32.Application.Amonetize

14.2.24

Malwarebytes

PUP.Optional.Amonetize

v2014.02.24.01

McAfee

Artemis!CB11E5706DBD

5600.7209

Reason Heuristics

PUP.Installer.ShetefSolutionsConsulting1998.?

14.8.8.3

Trend Micro House Call

TROJ_GEN.F47V0219

7.2.55

File size:

149.1 KB (152,704 bytes)

Product version:

2.1.12

Original file name:

Installer.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Common path:

C:\users\{user}\appdata\local\temp\chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe

Digital Signature

Signed by:

Shetef Solutions & Consulting (1998) Ltd.

Authority:

Thawte, Inc.

Valid from:

7/23/2013 2:00:00 AM

Valid to:

7/24/2014 1:59:59 AM

Subject:

CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7C23DBB97FAFBB9D28D413F836202024

File PE Metadata

Compilation timestamp:

2/19/2014 5:10:26 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:u2pQFt1BNti8GVDPhITqWjW2tYHz3rYEUugz+30NlnD7BnBii:/QFt1B94PjWK2t0z3rwz+ENlnxBii

Entry address:

0x59A80

Entry point:

60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA]

Code size:

128 KB (131,072 bytes)

The file chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe has been seen being distributed by the following 14 URLs.

http://download.quadownload.com/.../get.php?q=golden software grapher 10.1. download&source=500&campaign=2789&ti3=

http://download.venturedownload.com/.../get.php?q=Akruti_Multi_Font_Engine_Software.rar&ti1=1460000&ti2=0&ti3=2014-02-19T18:35:18.695260 00:00

http://www.totalitydownload.com/download.php?version=1.1.5.98&campid=3516&instid[appname]=the.wire.s02e01.avi_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=500000&ti2=2&ti3=2014-02-19T18:43:49.891104 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=the.wire.s02e01.avi&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=500000&ti2=2&ti3=2014-02-19T18:43:49.891104 00:00&parameter=the.wire.s02e01.avi&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=500000&ti2=2&ti3=2014-02-19T18:43:49.891104 00:00&parameter=the.wire.s02e01.avi&ti1=500000&ti2=2&ti3=2014-02-19T18:43:49.891104 00:00

http://download.getlinksinaseconds.com/.../get.php?q=the.wire.s02e01.avi&ti1=500000&ti2=2&ti3=2014-02-19T18:43:49.891104 00:00

http://www.totalitydownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=Nancy Drew Audio Books.rar_Downloader&instid[appsetupurl]=http://go.venturedownload.com/getfast/download.cgi?9&ti1=1460000&ti2=0&ti3=2014-02-20T03:35:20.412455 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.venturedownload.com/d1/logo150x150.png&prefix=Nancy Drew Audio Books.rar&instid[thankyoupage]=http://download.venturedownload.com/.../thank_you.php?ti1=1460000&ti2=0&ti3=2014-02-20T03:35:20.412455 00:00&parameter=Nancy Drew Audio Books.rar&instid[interrupted]=http://download.venturedownload.com/.../interrupted.php?ti1=1460000&ti2=0&ti3=2014-02-20T03:35:20.412455 00:00&parameter=Nancy Drew Audio Books.rar&ti1=1460000&ti2=0&ti3=2014-02-20T03:35:20.412455 00:00

http://download.venturedownload.com/.../get.php?q=Nancy_Drew_Audio_Books.rar&ti1=1460000&ti2=0&ti3=2014-02-20T03:35:20.412455 00:00

http://www.totalitydownload.com/download.php?version=1.1.5.98&campid=3515&instid[appname]=Introduction To Psychology Active Learning Through Modules 12th Edition Download_Downloader&instid[appsetupurl]=http://go.tunydownloadsfast.com/getfast/download.cgi?9&ti1=990000&ti2=0&ti3=2014-02-20T06:31:25.502519 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.tunydownloadsfast.com/d1/logo150x150.png&prefix=Introduction To Psychology Active Learning Through Modules 12th Edition Download&instid[thankyoupage]=http://download.tunydownloadsfast.com/.../thank_you.php?ti1=990000&ti2=0&ti3=2014-02-20T06:31:25.502519 00:00&parameter=Introduction To Psychology Active Learning Through Modules 12th Edition Download&instid[interrupted]=http://download.tunydownloadsfast.com/.../interrupted.php?ti1=990000&ti2=0&ti3=2014-

http://download.tunydownloadsfast.com/.../get.php?q=Introduction To Psychology Active Learning Through Modules 12th Edition Download&ti1=990000&ti2=0&ti3=2014-02-20T06:31:25.502519 00:00

http://www.totalitydownload.com/download.php?version=1.1.5.98&campid=3039&instid[appname]=True Basic Bronze Edition.rar_Downloader&instid[appsetupurl]=http://go.venturedownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=2014-02-19T17:03:12.855810 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.venturedownload.com/d1/logo150x150.png&prefix=True Basic Bronze Edition.rar&instid[thankyoupage]=http://download.venturedownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=2014-02-19T17:03:12.855810 00:00&parameter=True Basic Bronze Edition.rar&instid[interrupted]=http://download.venturedownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=2014-02-19T17:03:12.855810 00:00&parameter=True Basic Bronze Edition.rar&ti1=1405000&ti2=0&ti3=2014-02-19T17:03:12.855810 00:00

http://download.venturedownload.com/.../get.php?q=True_Basic_Bronze_Edition.rar&ti1=1405000&ti2=0&ti3=2014-02-19T17:03:12.855810 00:00

http://www.totalitydownload.com/download.php?version=1.1.5.98&campid=3039&instid[appname]=Torrent True Basic Gold Keygen Torrent Download_Downloader&instid[appsetupurl]=http://go.thankdownload.com/getfast/download.cgi?9&ti1=945000&ti2=0&ti3=2014-02-19T16:52:15.682318 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.thankdownload.com/d1/logo150x150.png&prefix=Torrent True Basic Gold Keygen Torrent Download&instid[thankyoupage]=http://download.thankdownload.com/.../thank_you.php?ti1=945000&ti2=0&ti3=2014-02-19T16:52:15.682318 00:00&parameter=Torrent True Basic Gold Keygen Torrent Download&instid[interrupted]=http://download.thankdownload.com/.../interrupted.php?ti1=945000&ti2=0&ti3=2014-02-19T16:52:15.682318 00:00&parameter=Torrent True Basic Gold Keygen Torrent Download&ti1

http://download.thankdownload.com/.../get.php?q=Torrent True Basic Gold Keygen Torrent Download&ti1=945000&ti2=0&ti3=2014-02-19T16:52:15.682318 00:00

http://www.amoninst.com/download.php?version=1.1.5.98&campid=3061&instid[appname]=Setup&instid[appsetupurl]=http://199.91.152.26/v209i3gg79hg/l5pme7bwdvoah89/Setup_2.exe&instid[cmdline]=&instid[appimageurl]=http://www.focus.ly/wp-content/.../setup.gif&prefix=Setup&instid[thankyoupage]=

http://gg.gg/h1i1

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.softologic.com (174.37.181.31:80)

TCP (HTTP SSL):

Connects to www.ibbalance.com (173.192.190.227:443)

TCP (HTTP):

Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com (54.221.252.69:80)

Remove chinatown 720p hdtv x264 yify.rar__3515_i370728624_il925897.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.