» I Want This.exe
Overview
Analysis
File Details
Programs (1)
Network (9)

I Want This.exe

I Want This

Amazing Apps

This is part of a distribution package that is classified as adware distributed by 50onRed. This adware is used to interact with the installed web browsers and inject ads and modify the default search and homepages. The application I Want This.exe by Amazing Apps has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program I Want This by 215 Apps which is a potentially unwanted software program. While running, it connects to the Internet address tlb.hwcdn.net on port 80 using the HTTP protocol.

File name:

I Want This.exe

Publisher:

215 Apps (signed by Amazing Apps)

Product:

I Want This

Description:

I Want This exe

Version:

1.1.149.50

MD5:

6b685d0306e64a14a55b3c1bcf0decfe

SHA-1:

5c14f9a336a1aed2c93e116fccefaa00df5684d1

SHA-256:

a66aeca9ca4f5f73fd09621bce5f366995ca8e38d4a2b096d81753de4aca53a7

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

5/8/2024 8:20:38 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.50OnRed (M)

16.9.5.16

File size:

430.9 KB (441,216 bytes)

Product version:

1.1.149.50

Original file name:

I Want This.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\i want this\i want this.exe

Digital Signature

Signed by:

Amazing Apps

Authority:

Thawte, Inc.

Valid from:

5/1/2012 4:00:00 AM

Valid to:

5/2/2013 3:59:59 AM

Subject:

CN=Amazing Apps, O=Amazing Apps, L=Philadelphia, S=Pennsylvania, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

2E307885017928B61D4F2CEF5EB10A05

File PE Metadata

Compilation timestamp:

3/20/2012 2:43:16 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:R4k3ViprBlWaQBDrIrUgbVDgmb33cEfpjUb15R9xrd8s:R4kWg0URXdx

Entry address:

0x41D23

Entry point:

E8, BA, 90, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, 74, D0, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, 40, 96, 46, 00, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18, 89, 5D, F8, 39, 5D, 24, 75, 0B, 8B, 45, 08, 8B, 00, 8B, 40, 04, 89, 45, 24, 8B, 35, 44, A0, 45, 00... 
[+]

Entropy:

6.4483

Code size:

352.5 KB (360,960 bytes)

The file I Want This.exe has been discovered within the following program.

I Want This by 215 Apps

I Want This (i want this.dll) is a web browser extension loaded with Internet Explorer via the I Want This BHO.

iw.antthis.com

88% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to s3-website-us-east-1.amazonaws.com (54.231.98.178:80)

TCP (HTTP):

Connects to tlb.hwcdn.net (69.16.175.10:80)

TCP (HTTP):

Connects to hwcdn.net (69.16.175.42:80)

Remove I Want This.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.