home

downloadfilesetup__2299_i983312362_il2162724.exe

TEHSNABSTROY LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application downloadfilesetup__2299_i983312362_il2162724.exe by TEHSNABSTROY has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
TEHSNABSTROY LLC  (signed and verified)

Version:
1.1.5.27

MD5:
2a955202f60544dacdcc8e466b37bc1f

SHA-1:
6fe94d2d2337ae5864ded12bab74ea8ca101691f

SHA-256:
5d418dd5fbb738d08598822e5acc5d536781b42aa231cb629bb906bc2eb97ede

Scanner detections:
21 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 2:19:28 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Generic.959515
928

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.07.09

avast!
Win32:Adware-gen [Adw]
2014.9-140721

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.14721

Bitdefender
Adware.Generic.959515
1.0.20.1010

Dr.Web
Adware.Downware.5488
9.0.1.0188

ESET NOD32
Win32/Amonetize.BF.gen (variant)
8.10066

Fortinet FortiGate
Riskware/Amonetize
7/21/2014

F-Secure
Adware.Generic.959515
11.2014-21-07_2

G Data
Adware.Generic.959515
14.7.24

IKARUS anti.virus
PUA.Amonetize
t3scan.1.6.1.0

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.3526

MicroWorld eScan
Adware.Generic.959515
15.0.0.606

NANO AntiVirus
Riskware.Win32.Amonetize.dcblyg
0.28.0.60698

Panda Antivirus
Trj/CI.A
14.07.21.05

Qihoo 360 Security
HEUR/Malware.QVM10.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.TEHSNABSTROY.m
14.7.7.9

Sophos
Generic PUA DD
4.98

Trend Micro House Call
Suspicious_GEN.F47V0702
7.2.202

VIPRE Antivirus
Trojan.Win32.Generic
31100

File size:
327.1 KB (334,920 bytes)

Product version:
1.1.5.27

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Language:
English (United States)

Digital Signature
Signed by:
TEHSNABSTROY LLC

Authority:
COMODO CA Limited

Valid from:
6/18/2014 5:00:00 PM

Valid to:
6/19/2015 4:59:59 PM

Subject:
CN=TEHSNABSTROY LLC, O=TEHSNABSTROY LLC, STREET="UL. NIKOLYAMSKAYA, 9", L=G. MOSKVA, S=G. MOSKVA, PostalCode=109240, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00F4B1A67457808CFF0300CD93C4050F05

File PE Metadata
Compilation timestamp:
6/24/2014 12:20:57 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:ZLaHr6lGYxpTBLljnlUf1SYmRHE1ZDY60TEuCaX/OrZ33xlSasR:JamsYxpT3ljPe2TE+EnXxsR

Entry address:
0xE2F7

Entry point:
E8, BA, 46, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 14, FD, 41, 00, 00, 75, 18, E8, B4, 3D, 00, 00, 6A, 1E, E8, FE, 3B, 00, 00, 68, FF, 00, 00, 00, E8, 97, F6, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3, EB, 03, 33, C0, 40...
 
[+]

Code size:
82 KB (83,968 bytes)

The file downloadfilesetup__2299_i983312362_il2162724.exe has been seen being distributed by the following URL.

http://1stdl.org/.../?ref=p191.oc203.45236.203.72eb8e3305&prefix=DownloadFileSetup&url=&ti2=8550981621&country=IR&name=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.