home

JDownloader09Setup_win.exe

JDownloader

AppWork GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application JDownloader09Setup_win.exe by AppWork GmbH has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.bytesendclear.com and multiple other hosts. While running, it connects to the Internet address ns303382.ip-94-23-204.eu on port 443.
Publisher:
AppWork GmbH  (signed and verified)

Product:
JDownloader

Version:
0.9

MD5:
9f1a5e52b90a55fa1e6e4585d4206474

SHA-1:
30d3fdd3aa5072bb766e182c013cf2ce063e6bd3

SHA-256:
3a6dbe5645a8865c1b29a4f06ee1eee89498f554781f35083c5f51507b371013

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/24/2024 3:23:11 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Installer.AppWorkGmbH.W
14.7.28.0

File size:
25.3 MB (26,546,376 bytes)

Product version:
0.9

Copyright:
AppWork GmbH

Original file name:
JDownloader09Setup_win.exe

File type:
Executable application (Win64 EXE)

Bundler/Installer:
installCore

Common path:
C:\users\{user}\downloads\downloader\jdownloader\jdownloader09setup_win.exe

Digital Signature
Signed by:
AppWork GmbH

Authority:
GlobalSign nv-sa

Valid from:
3/1/2011 3:00:48 PM

Valid to:
3/1/2014 3:00:41 PM

Subject:
E=e-mail@appwork.org, CN=AppWork GmbH, O=AppWork GmbH, L=Fürth, S=Bavaria, C=DE

Issuer:
CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:
0100000000012E71E7355C

File PE Metadata
Compilation timestamp:
7/27/2012 3:23:00 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
786432:xozFusVY2zXyfelNftyrIxGAenkHLX8gP:0VFrygfxDNLMg

Entry address:
0x11F8

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 80, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
181.5 KB (185,856 bytes)

The file JDownloader09Setup_win.exe has been seen being distributed by the following 7 URLs.

http://www.bytesendclear.com/WVl6OTRQVkZMV1d4eGRUWk9ObWg2WVRSNU5uSnlOV055TTA5V1pHa3lhR2RuYVdWUmNVTXhPRXRNV205SGFFa2xNMFFtWXoxck1qTkJURmRuYm1ZeFpXRkJVMGhQVVd0emNISk9USFkyT0hrek1sQXpXSFZTTjFKSk5WWnlTbmxhU0dZMGNHZDNXVEZXT0VSTmVHeElWVWdsTWtaRlRIQllVR1ZLVXpKYWNVaFNRbTlyTTFsNmIyaHNXWHBwVUU1SWIzZ3pRMWgzYXpaa1pVbDZkRGhLTkd3ME1ETlNRbFoyYkRKMlMyd2xNa0pMYTJGWVNGcFFUV1F5ZVhweWJWWlBWVWc0SlRKQ1ZHVXhjRmRuVW5kbE5WRWxNMFFsTTBRbVpUMHhKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1abWxzWlhNdFpHOTNibXh2WVdRdWNHOXlZV1J1YVd0a2IyZHllUzV3YkNVeVprbHVkR1Z5Ym1WMFNWTnBaV05wSlRKbVUyTnBZV2RoYm1sbFVHeHBhMjkzSlRKbVNrUnZkMjVzYjJGa1pYSWxNbVpLUkc5M2JteHZZV1JsY2xObGRIVndMbVY0WlNaa2IzZHViRzloWkVGelBVcEViM2R1Ykc5aFpHVnlLekF1T1M0MU9ERXVaWGhs

http://www.bytesendclear.com/WVl6OTRQV3hwUldRNGNVOWxZVXA0T1VGVGRWUkxjbEJHWTJKMVVVRmplV3cxTUVaU1YwSkpkRlpJWWtKd1FrRWxNMFFtWXoxWFRYSXpkM0pXT0RkcGNYTjFOV2R6YmpFNVFUQkJhR3RvTlZSeVQyMUhPVXhITm1NMkpUSkNiaVV5UmxocWNsQTVaek5EV2xoNU56VjRabG93Y2tnMWNpVXlRa2NsTWtKUE5FWnBVWEZqUTJsaWJUZG9RbVJuTlRaclZUZFpSMWhhYkVKR1lYUkRRbU40UTBVMmRtUndTMWRtWTNsbU5HRk9SMXAzUVVOUGVsVjZha1pXZDJGdFNVaDBNR3g2YW5WYVZXOVVNVWR4Vm1OeU5FaDBRU1V6UkNVelJDWmxQVEVtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVptYVd4bGN5MWtiM2R1Ykc5aFpDNXdiM0poWkc1cGEyUnZaM0o1TG5Cc0pUSm1TVzUwWlhKdVpYUkpVMmxsWTJrbE1tWlRZMmxoWjJGdWFXVlFiR2xyYjNjbE1tWktSRzkzYm14dllXUmxjaVV5WmtwRWIzZHViRzloWkdWeVUyVjBkWEF1WlhobEptUnZkMjVzYjJGa1FYTTlTa1J2ZDI1c2IyRmtaWElyTUM0NUxqVTRNUzVsZUdVPQ==

http://www.signtowntoday.com/WVl6OTRQWEYwWjFwUFJHMUdkeVV5UmlVeVJtbENjSGtsTWtJNVFVSjBVbkJaYkcxbE5qRmFkbXRoZGpOalZrVXpZbFpYTUhjbE0wUW1ZejExU2xwclRHZ3dXa2QyVDJOeFVqWldhVXBTY1RaNWIwOUNUVmRpWnpjbE1rWlBNbFJTV25ZbE1rSjJVSE54ZUcxNmJVVnJiQ1V5UW1seU5WZEhiSFJ3TkRObGRXVlVKVEpDWjJock4zZEJSMVk0UkhKd2J6azBhMXAwUkVGblJFcFNVRWd5UzAxUEpUSkNTMmt6ZEdoM09VOU1Xa1puVDFneVUwWkRNV1JHUm01NmRGbHVRazFzYUdFNVNuRkZhWEpwWjAxd1IzUm9VM2xhUVZaRlp6UlJKVE5FSlRORUptVTlNU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVpwYkdWekxXUnZkMjVzYjJGa0xuQnZjbUZrYm1sclpHOW5jbmt1Y0d3bE1tWkpiblJsY201bGRFbFRhV1ZqYVNVeVpsTmphV0ZuWVc1cFpWQnNhV3R2ZHlVeVprcEViM2R1Ykc5aFpHVnlKVEptU2tSdmQyNXNiMkZrWlhKVFpYUjFjQzVsZUdVbVpHOTNibXh2WVdSQmN6MUtSRzkzYm14dllXUmxjaXN3TGprdU5UZ3hMbVY0WlE9PQ==

http://www.majorgeeks.com/index.php?ct=files&action=download&

http://www.storage.programosy.pl/JDownloader09Setup_win_[www.programosy.pl].exe

http://www.programosy.pl/.../pobierz,jdownloader,2.html

http://installer.jdownloader.org/JDownloader09Setup_win.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to update1.jdownloader.org  (178.63.91.110:80)

TCP (HTTP SSL):
Connects to ns303382.ip-94-23-204.eu  (94.23.204.158:443)

Remove JDownloader09Setup_win.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.