home

hohner_die_ersten_30_jahre.rar_downloader.exe

YourFileDownloader Installer

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application hohner_die_ersten_30_jahre.rar_downloader.exe by Via Advertising Group Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dn.yourfiledownloader.com.
Publisher:
http://yourfile-downloader.com  (signed by Via Advertising Group Limited)

Product:
YourFileDownloader Installer

Version:
1, 0, 465, 1

MD5:
795a70d010d68d189ad918557921ef55

SHA-1:
63362b52298f2df370b0d9582e1a41860d2b4299

SHA-256:
c8b47c90c739f38acfdae14d2e52ded7dba7fa31b1a2b0ea81512b255e70459f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/16/2024 12:27:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Via Advertising (M)
16.8.6.9

File size:
3.8 MB (3,966,072 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\hohner_die_ersten_30_jahre.rar_downloader.exe

Digital Signature
Signed by:
Via Advertising Group Limited

Authority:
COMODO CA Limited

Valid from:
4/12/2013 2:00:00 AM

Valid to:
4/12/2016 1:59:59 AM

Subject:
CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BABC309174F531C6762BBA466401FEAF

File PE Metadata
Compilation timestamp:
12/16/2014 4:55:31 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:rjgTqdp6tWpF6+3dwo6VuoMe8+nDnktP7woDe0TT79p:rj6qP6tWpF3b6Vuu7sDwotTT79p

Entry address:
0x3F6153

Entry point:
54, 9C, 9C, C7, 44, 24, 08, 45, 7D, 65, 69, 60, C7, 44, 24, 24, 7B, 22, 0C, 44, 54, C6, 04, 24, CC, 9C, 8D, 64, 24, 2C, E9, 82, A1, 35, 00, 66, 0F, BA, E0, 06, 9C, 83, F9, 07, E9, 56, CB, FF, FF, 00, 00, 47, 65, 74, 4D, 6F, 64, 75, 6C, 65, 46, 69, 6C, 65, 4E, 61, 6D, 65, 41, 00, 02, E1, 1C, 2C, 2A, 90, 6F, CA, 17, 42, CD, 26, EC, 35, 86, 55, 72, A1, 7A, 89, 7A, 41, 56, 6D, 36, E5, A7, 2E, E1, 0A, D5, 56, E9, 12, C8, 98, 24, EC, EE, B6, 83, 93, E0, 99, CD, B4, 33, 38, F6, 0A, EB, 86, EE, 44, 25, 2C, 07, 2F...
 
[+]

Code size:
785 KB (803,840 bytes)

The file hohner_die_ersten_30_jahre.rar_downloader.exe has been seen being distributed by the following URL.

http://dn.yourfiledownloader.com/j5GtWGrerElZ0KRaVd2jMHrZuxgh8IYhd6yvKjS6gCE4uJZqE TbahLt220e6tcQW76cAw/RyVsF1cxZHJhgAUqCYAUdmW1GddJ5DSued oto2H ImUks3BnceY5YxyieHhB5D14RugSKVn3D3lV0AB5QYkRT1SNAkBO8BlHNN0KXjyKzHxvyeNVIeDpVDig5WM7qK9wf7/yNwKm6nVZ57B XPmbYEftk3IYvvUwEJDGYUDQhlVI3I8GS4qODOLHil2wwqERsM6nQbvN BqjYK9Js3KzvdpD8Oj6Mr/mh3C/ JgjxODbdILhzmu18dUe3LrHRpzEhBrDl40X3Nz8RNjHoE4/.../cKPueyCi7CkoqdEyJqmHbkE=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.