» herdprotect__2309_il293354.exe
Overview
Analysis
File Details
Downloads (6)

herdprotect__2309_il293354.exe

Wilmaonline LTD.

Warning, this is an illegal version of herdProtect (repackaged and distributed without Reason Software Company's permission) by a company (Wilmaonline LTD.) that bundles adware. Please make sure that you uninstall this version and download a legitimate copy from our site.

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application herdprotect__2309_il293354.exe by Wilmaonline has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

Wilmaonline LTD. (signed and verified)

Version:

1.1.5.26

MD5:

c4fd198503e6f1c4b6abbabae9453b76

SHA-1:

ce44c1d262af580a7b4426cd4e6eda68b851401d

SHA-256:

e16fad3e50c5fa93d6f9b601e43fe43f4d1795fc041910e224d3c2b458c9f2d6

Scanner detections:

16 / 68

Status:

Adware

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/25/2024 11:25:42 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.03.10

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.135.226

avast!

Win32:Dropper-gen [Drp]

2014.9-140312

AVG

Generic_r

2015.0.3510

Dr.Web

Adware.Downware.1575

9.0.1.099

ESET NOD32

Win32/Amonetize.AG (variant)

8.9519

Fortinet FortiGate

Riskware/Amonetize

4/9/2014

IKARUS anti.virus

Virus.Win32.Dropper

t3scan.2.2.29

Malwarebytes

PUP.Optional.Amonetize.A

v2014.03.12.01

McAfee

Artemis!113F36A23A03

5600.7166

Qihoo 360 Security

HEUR/Malware.QVM01.Gen

1.0.0.1015

Reason Heuristics

PUP.Wilmaonline.AA

14.3.12.13

Trend Micro House Call

TROJ_GEN.F47V0309

7.2.71

VIPRE Antivirus

Trojan.Win32.Generic

27232

XVirus List

Win.Detected

2.3.31

File size:

149 KB (152,624 bytes)

Product version:

1.1.5.26

Original file name:

i.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup

Language:

English (United States)

Common path:

C:\users\{user}\downloads\herdprotect__2309_il293354.exe

Digital Signature

Signed by:

Wilmaonline LTD.

Authority:

Thawte, Inc.

Valid from:

7/2/2013 3:00:00 AM

Valid to:

7/3/2014 2:59:59 AM

Subject:

CN=Wilmaonline LTD., OU=Wilmaonline LTD., O=Wilmaonline LTD., L=Raanana, S=ISRAEL, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

56AD7789FEA4A324513D7CB6C47F1DE3

File PE Metadata

Compilation timestamp:

3/9/2014 2:46:51 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:WUKzbDmXByXhTPileScZWnbnaF2hrOtRP2NEQe/:czbDmXBITPo7c2nnOtWE7/

Entry address:

0x59B10

Entry point:

60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA]

Code size:

128 KB (131,072 bytes)

The file herdprotect__2309_il293354.exe has been seen being distributed by the following 6 URLs.

http://stream.get-tune.net/file/244370390/219216594/1578403370/.../MUSIC_SWAGG_HIP_HOP_-_MUSIC_SWAGG_HIP_HOP_(get-tune.net).mp3

http://www.singulardownload.com/download.php?version=1.1.5.26&campid=6815&instid[appname]=Candry Crush Hack&instid[appsetupurl]=www.shdurrrrr.com/asdsue111e/download.exe&instid[cmdline]=&instid[appimageurl]=http://static6.businessinsider.com/image/.../heres-proof-that-candy-crush-influences-everything--including-religion.jpg&prefix=Candry Crush Hack&instid[thankyoupage]=

http://q=http://.../1k5IuUc4ndycrush

http://www.transdownload.com/download.php?version=1.1.5.26&campid=2299&instid[appsetupurl]=&instid[appname]=File.Download&instid[appimageurl]=http://.../dl.png&prefix=File.Download&ti1=p191.ar.0.results.39caec7f22&ti2=4485859572

http://www.optiondownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Castle Clash Hack V7 1 2 Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1898308803.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Castle Clash Hack V7 1 2 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1898308803

Remove herdprotect__2309_il293354.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.