» FDM__3472_i1066141313_il42.exe
Overview
Analysis
File Details
Downloads (5)

FDM__3472_i1066141313_il42.exe

KOMPANIYA КRЕАТА LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application FDM__3472_i1066141313_il42.exe by KOMPANIYA КRЕАТА has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.

File name:

Publisher:

KOMPANIYA КRЕАТА LLC (signed and verified)

Version:

1.1.5.90

MD5:

d9d6d40c75ac877ebe0caa25317289fb

SHA-1:

6bbd2245f7198cecba0b1a9c764fa8fb45d93967

SHA-256:

b6303c1fddb3fa1b7bb246a3b17586f403b4dc29fdaaa3bf7963b28db18ba0b6

Scanner detections:

21 / 68

Status:

Adware

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

5/16/2024 1:28:23 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.Amonetize.N

927

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.07.21

Avira AntiVirus

APPL/Amonetize.Z

7.11.163.238

avast!

Win32:Amonetize-CL [PUP]

2014.9-140722

AVG

Generic

2015.0.3405

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.14722

Bitdefender

Application.Bundler.Amonetize.N

1.0.20.1015

Dr.Web

Adware.Downware.5913

9.0.1.0203

ESET NOD32

Win32/Amonetize.BI (variant)

8.10123

F-Secure

Application.Bundler.Amonetize

11.2014-22-07_3

G Data

Application.Bundler.Amonetize

14.7.24

IKARUS anti.virus

not-a-virus:AdWare.Amonetize

t3scan.1.6.1.0

Kaspersky

not-a-virus:AdWare.Win32.Amonetize

14.0.0.3521

Malwarebytes

PUP.Optional.Downloader

v2014.07.22.05

McAfee

Artemis!D9D6D40C75AC

5600.7061

MicroWorld eScan

Application.Bundler.Amonetize.N

15.0.0.609

NANO AntiVirus

Riskware.Win32.Amonetize.dchxoa

0.28.2.60881

Panda Antivirus

Trj/CI.A

14.07.22.05

Qihoo 360 Security

Win32/Application.bcb

1.0.0.1015

Reason Heuristics

PUP.Installer.KOMPANIYAR.AA

14.7.22.17

VIPRE Antivirus

Amonetize

31430

File size:

345.2 KB (353,504 bytes)

Product version:

1.1.5.90

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\fdm__3472_i1066141313_il42.exe

Digital Signature

Signed by:

KOMPANIYA КRЕАТА LLC

Authority:

Thawte, Inc.

Valid from:

6/16/2014 3:00:00 AM

Valid to:

6/17/2015 2:59:59 AM

Subject:

CN=KOMPANIYA КRЕАТА LLC, O=KOMPANIYA КRЕАТА LLC, L=Kharkiv, S=Kharkiv, C=UA

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

04CA5D77531C0E61E4DE2CB0E6E4B5B2

File PE Metadata

Compilation timestamp:

7/20/2014 12:03:57 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:dBieRGukt2xUBTBIeIONtVW/UqxmAe9xWhTJonMGzXmq6xGWxsvvl1:/vsN2xUBTimWcqkJ9x4wmhxDxs3l1

Entry address:

0x14C32

Entry point:

E8, E8, 5F, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 3C, 8E, 3F, 00, 00, 75, 18, E8, C8, 59, 00, 00, 6A, 1E, E8, 12, 58, 00, 00, 68, FF, 00, 00, 00, E8, 10, F6, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3, EB, 03, 33, C0, 40, 50, 6A, 00, FF, 35, 3C, 8E, 3F, 00, FF, 15... 
[+]

Code size:

116.5 KB (119,296 bytes)

The file FDM__3472_i1066141313_il42.exe has been seen being distributed by the following 5 URLs.

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3039&instid[appname]=The Secret Life of the American Teenager S01E ..._Downloader&instid[appsetupurl]=http://go.bragdownload.com/getfast/download.cgi?9&ti1=1625000&ti2=0&ti3=2014-07-20T09:42:25.333863 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.bragdownload.com/d1/logo150x150.png&prefix=The Secret Life of the American Teenager S01E ...&instid[thankyoupage]=http://download.bragdownload.com/.../thank_you.php?ti1=1625000&ti2=0&ti3=2014-07-20T09:42:25.333863 00:00&parameter=The Secret Life of the American Teenager S01E ...&instid[interrupted]=http://download.bragdownload.com/.../interrupted.php?ti1=1625000&ti2=0&ti3=2014-07-20T09:42:25.333863 00:00&parameter=The Secret Life of the Americ

http://download.bragdownload.com/.../get.php?q=The Secret Life of the American Teenager S01E ...&ti1=1625000&ti2=0&ti3=2014-07-20T09:42:25.333863 00:00

http://www.generaldownload.com/tdownload.php?s1=a3ed4b3af9e5a0b5a7d46efc45cd281cc4da4ca5&t1=1405849310&myref=dm&campid=7123&version=1.1.5.90&instid[appname]=Keygen Installer&instid[appsetupurl]=http://82.118.235.173/Keygen Installer.zip&instid[appimageurl]=https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTxoLer5Ytu9PdnrF1WsTHD2cC_Wa2IxWG84gDglmylAXRXLvQu&prefix=Keygen Installer&instid[thankyoupage]=http://cdn2.business2community.com/wp-content/uploads/2013/.../thank-you-page-295x300.jpg&AMt=1405849130550&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.more-manger-files.com/allddT.html?myref=dm&campid=7123&version=1.1.5.90&instid[appname]=Keygen Installer&instid[appsetupurl]=http://82.118.235.173/Keygen Installer.zip&instid[appimageurl]=https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTxoLer5Ytu9PdnrF1WsTHD2cC_Wa2IxWG84gDglmylAXRXLvQu&prefix=Keygen Installer&instid[thankyoupage]=http://cdn2.business2community.com/wp-content/uploads/2013/.../thank-you-page-295x300.jpg&AMt=1405849130550&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.xdisc.biz/tracking202/.../go.php?acip=516&pci=420360998

Remove FDM__3472_i1066141313_il42.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.