home

diamondata_wd.exe

diamondata

This is the installer/setup program for a Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application diamondata_wd.exe by diamondata has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.windows-7-themes.com.
Publisher:
diamondata  (signed and verified)

MD5:
bcae16a0c06073da4bdfd7e66dda9453

SHA-1:
46aa24ec6b2032d2e0983d16234585242c216e3e

SHA-256:
88c9f06cbb160e5ef3b5999492dc8601ad86542cec11af7b9810ec6a5777b4c6

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 9:56:28 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Plugin.100
9.0.1.032

ESET NOD32
Win32/BrowseFox
8.9345

herdProtect (fuzzy)
variant of rolimno_vt.exe (Adware)
2014.4.5.9

Malwarebytes
PUP.Optional.DiamonData.A
v2014.02.01.02

McAfee
Artemis!BCAE16A0C060
5600.7232

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
PUP.diamondata.N
14.8.7.21

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF
23.00.65.14130

SUPERAntiSpyware
Trojan.Agent/Gen-BHO
10810

Trend Micro House Call
TROJ_GEN.F47V1001
7.2.32

VIPRE Antivirus
Trojan.Win32.Generic
25876

ViRobot
Trojan.Win32.BHO.175208
2011.4.7.4223

File size:
171.1 KB (175,208 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\diamondata_wd.exe

Digital Signature
Signed by:
diamondata

Authority:
VeriSign, Inc.

Valid from:
8/13/2013 1:00:00 AM

Valid to:
8/14/2015 12:59:59 AM

Subject:
CN=diamondata, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=diamondata, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
013DE313C00D49CFC0FA964B3315CD82

File PE Metadata
Compilation timestamp:
12/5/2009 10:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:4Lk395hYXJsCP46nEVSVbJm9anH7l1m/GqMHJGULvA:4QqDNEANwYnH7nm/G/HcN

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file diamondata_wd.exe has been seen being distributed by the following URL.

http://www.windows-7-themes.com/.../Diamondata_wd.exe

Remove diamondata_wd.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.