home

hdfilm.exe

eDownload Module

Banyan Tree Technology Limited

The application hdfilm.exe by Banyan Tree Technology Limited has been detected as adware by 6 anti-malware scanners. This is an adware bundler (AKA ElexNetDownload) that will include additional unwanted offers in the download and install process. During install it will establish a connection to twonext.com and xingcloud.com to determine what offers to show the user (based on what is already installed and where they live).The file has been seen being downloaded from dl.elex.soft365.com.
Publisher:
Banyan Tree Technology Limited  (signed and verified)

Product:
eDownload Module

Version:
5.1.8.2217

MD5:
ab9d4833edba1fd05d31e1bf12da4460

SHA-1:
6d907a0fab71b10ca125b8c1415624ded72f3afa

SHA-256:
dcf3c5dc1b30ae899fc5ddbc90d5d12103e73af9921de4546ea1c407489e0ec9

Scanner detections:
6 / 68

Status:
Adware

Explanation:
Software bundler and update mechanism that will attempt to install adware offers.

Analysis date:
4/26/2024 8:18:39 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-BEN [Adw]
2014.9-140321

AVG
MalSign.Generic
2015.0.3529

ESET NOD32
Win32/ELEX (variant)
8.9085

IKARUS anti.virus
AdWare.Win32.ELEX
t3scan.2.2.29

Reason Heuristics
PUP.BanyanTreeTechnologyLimited.G
14.3.21.2

VIPRE Antivirus
Elex Installer
23634

File size:
449.1 KB (459,872 bytes)

Product version:
5.1.8.2217

Copyright:
Copyright 2013

Original file name:
eDownload.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\hdfilm.exe

Digital Signature
Signed by:
Banyan Tree Technology Limited

Authority:
GlobalSign nv-sa

Valid from:
1/10/2013 1:18:54 PM

Valid to:
1/11/2015 1:18:54 PM

Subject:
CN=Banyan Tree Technology Limited, O=Banyan Tree Technology Limited, L=HongKong, S=HongKong, C=HK

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C63E4490F9D28667737C8DE7D3B6805D

File PE Metadata
Compilation timestamp:
3/29/2013 3:29:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:6MLUUGWkbJB5dVoa2EJTNDV9k4ohdP3T3a7PRwO0x3UK3/0dAJaegivhhiAJeyKI:5sJBHVoa2ERNUhZSRwa+/ThTi2eyK

Entry address:
0xE0AD0

Entry point:
60, BE, 00, 70, 49, 00, 8D, BE, 00, A0, F6, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.4532

Packer / compiler:
UPX 2.90LZMA]

Code size:
296 KB (303,104 bytes)

The file hdfilm.exe has been seen being distributed by the following URL.

http://dl.elex.soft365.com/.../generator?short=see_692_a110711daa4196b71b55ca80c672fe31

Remove hdfilm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.