home

f832c961-d41a-27f4-4cd3-b7faf06f48c4_1d1e59374231449

Jul Ink

The file f832c961-d41a-27f4-4cd3-b7faf06f48c4_1d1e59374231449 has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from 293789.superfastdownload000.site.
Publisher:
Jul Ink

Product:
Jul Ink

Description:
Jul

Version:
0.0.0.2

MD5:
3b8b1be5751581492002a58d477b1124

SHA-1:
09f52c08710cee4acb5bd0149ab23bdf7765daee

SHA-256:
360f3c74c24da8260e35dad5f034d1749915207dffd507503f05cb8056c530bb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 10:16:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Amonetize (M)
16.7.24.13

File size:
721.2 KB (738,511 bytes)

Product version:
0.0.0.2

Original file name:
jul2.exe

Language:
English (United States)

Common path:
C:\ProgramData\microsoft\microsoft antimalware\scans\filesstash\f832c961-d41a-27f4-4cd3-b7faf06f48c4_1d1e59374231449

File PE Metadata
Compilation timestamp:
7/23/2016 3:08:45 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:2CYvUq0T66X7VMB4niP9yXoYiqMTF0JsM9kH27MmfX7MtcTW/b3ITL:c+TLJMB3K2qc1MiHRSLRTOcL

Entry address:
0x6A5A

Entry point:
E8, A4, 27, 00, 00, E8, 00, 00, 00, 00, 50, B8, 2D, FE, FF, FF, 03, 44, 24, 04, 89, 44, 24, 04, 58, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 78, 03, 00, 00, 0F, BA, 25, 2C, 04, 43, 00, 01, 73, 07, F3, A4, E9, 27, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, DE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 50, F0, 42, 00, 01, 0F, 82, EA, 04, 00, 00, 0F...
 
[+]

Entropy:
7.5776

Code size:
131 KB (134,144 bytes)

The file f832c961-d41a-27f4-4cd3-b7faf06f48c4_1d1e59374231449 has been seen being distributed by the following URL.

http://293789.superfastdownload000.site/download3.php?x=25a0ee56cca35d2fa0fc33ff6c451100&id=BenShallon42&title=AVOX&u=aHR0cDovL2F2b3gueHl6L2ZpbGVzL0F2b3hDbGllbnRJbnN0YWxsZXIuZXhl

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.