home

launcher__3338_i395140339_il689050.exe

Installer

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application launcher__3338_i395140339_il689050.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Shetef Solutions & Consulting (1998) Ltd.  (signed and verified)

Product:
Installer

Version:
1.1.1.72

MD5:
fd84dd4be9f94f6ed233dab76ed0c744

SHA-1:
318d689049a8bde5f1f641e95bbed1c0ebc2ae01

SHA-256:
57fe716cb51d673d22fad1accbd6710b784f109532f43efc1aa06b27b4630279

Scanner detections:
12 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 5:13:16 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
14.04.17

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.143.108

avast!
Win32:Adware-BJY [PUP]
2014.9-140417

Dr.Web
Adware.Downware.1575
9.0.1.0107

ESET NOD32
Win32/Amonetize.AJ (variant)
8.9675

Fortinet FortiGate
Riskware/Amonetize
4/17/2014

Malwarebytes
PUP.Optional.Amonetize.A
v2014.04.17.12

McAfee
Artemis!FD84DD4BE9F9
5600.7157

Reason Heuristics
PUP.Installer.ShetefSolutionsConsulting1998.c
14.8.8.3

Sophos
Amonetize
4.98

Trend Micro House Call
TROJ_GEN.F47V0227
7.2.107

File size:
149.1 KB (152,704 bytes)

Product version:
2.1.12

Copyright:
Copyright(c), All Rights Reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\launcher__3338_i395140339_il689050.exe

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Authority:
Thawte, Inc.

Valid from:
7/23/2013 1:00:00 AM

Valid to:
7/24/2014 12:59:59 AM

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7C23DBB97FAFBB9D28D413F836202024

File PE Metadata
Compilation timestamp:
2/27/2014 5:32:09 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:w+djJ2cti89yNoHKoD8li2W5drPmrG2Itful42EJeosNGpPIH75ONs0Jk:zrt/H3DHo8uazeoCgPxs4k

Entry address:
0x599F0

Entry point:
60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.7911

Packer / compiler:
UPX 2.90LZMA]

Code size:
128 KB (131,072 bytes)

The file launcher__3338_i395140339_il689050.exe has been seen being distributed by the following 40 URLs.

http://fra1.ib.adnxs.com/click?yzDuBtFaxz_LMO4G0VrHPwAAAAAAAPg_yzDuBtFaxz_LMO4G0VrHP3J6kAYhU4FzickFmnR1UAkwXBJTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAEI0AAgQCAQIAAIoAAiMAPQAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=20,101,107&clientId=b6a8eeb4-9d82-45e3-9e8b-c4d49bf09d1d&l=http://www.geny.com/arrivee-et-rapports-pmu/2014-03-01-pmu-prix-de-selection_c592211&r=http://www.geny.com/reunions-courses-pmu&kw=PMU ,Arrivée et rapports ,Quinté+ ,Quarté+ ,Tiercé/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CImTl9DJrp2oCRACGPL0wbSQ5NTAcyIMODQuOTkuODEuMjM1KAEwsLjJmAU.&ti2=2076774&ti3=${APN}

http://fra1.ib.adnxs.com/click?hllo5zQLtD-GWWjnNAu0Pylcj8L1KNQ_hllo5zQLtD-GWWjnNAu0P889zwRugIJsVQ3R0bT3-CDaYBBTAAAAAD2HIAB2AgAAdgIAAAIAAADnSLcANj8FAAAAAQBVU0QAVVNEACADuAGLAwAArYwAAgQCAQIAAIwA7yQY6AAAAAA./cnd=!QwYNOAiZgLIBEOeR3QUYtv4UIAQ./referrer=http://ec2-54-198-218-48.compute-1.amazonaws.com//clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5561&capp=FlashPlayer&ti1=fra1CNWaxI7N9r38IBACGM_7vKbgjaDBbCIMODUuOTguMjEzLjIwKAEw2sHBmAU.&ti2=2131773&ti3=${APN}

http://fra1.ib.adnxs.com/click?p3fxfty-8z-nd_F-3L7zPwAAAAAAAPg_p3fxfty-8z-nd_F-3L7zP_acqs_eaZUtJsvSDs4TOXUMVxBTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAvo0AAgQCAQIAAIoAwCoBFQAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,302,7870&clientId=4f511835-b8ac-401f-85dd-3bfa0b46263e&l=http://www.sfr.fr/?sfrcpid=t1_marq-exacte_g_ls&sissr=1&r=http://www.google.fr/aclk?sa=l&ai=CCWYgAVcQU7KcI8OH7gb0y4DwDOCyqdME-LavjI0B0p6SFQgAEAEgmajZHlCwo8b7B2D7qe-C9AmgAej2kv4DyAEBqQIFbA4m-gK3PqoEH0_QV2jkhePGgVnBhy9x8Xw9uf18zcyUrXO6bx96tpCABZBOugUTCNPb65zB7rwCFYMZ4Qod0g4A3coFAIAHgIntAZAHAw&ei=AVcQU5PXH4OzhAfSnYDoDQ&sig=AOD64_1LoKDnbo8a9BAdgemDc6oVuVkjkA&rct=j&q=sfr&sqi=2&ved=0CC4Q0Qw&adurl=http://dms.netmng.com/si/cm/.../clickredirect.aspx?sidevicemodel=&sidevice=c&siplacement=&simobile=&sinetwork=g%

http://fra1.ib.adnxs.com/click?5_wUx4FX3D_n_BTHgVfcPwAAAAAAAPg_5_wUx4FX3D_n_BTHgVfcP8_Ml9-pwAR7dy636qKIzTM3ChFTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAr9QAAgQCAQIAAIoALCk5QgAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=28&clientId=9FD90075-E4DE-42A0-8E13-3A456181DE58&l=http://www.annuaire-mairie.fr/education-ecole-primaire-publique-chemin-rouge.html&r=https://www.google.fr//clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CPfc3NWulOLmMxACGM-Z3_ydlbCCeyIMOTAuMjkuMzkuMTUzKAEwt5TEmAU.&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?Pl3dsdim6z8-Xd2x2KbrPwAAAAAAAPg_Pl3dsdim6z8-Xd2x2KbrP6F73XepFjhsPvCgZRkW6BBa0xBTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAxrkAAgQCAQIAAIoAVyi6-AAAAAA./cnd=!0wYdPwjdg7gBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,294,298&clientId=76eb1b35-3c35-4b39-af1c-564ff09e73e2&l=http://www.pinoy-ako.info/tv-show-replay/80-24-oras/103279-24-oras-28-february-2014.html#sthash.ZHGAlouW.dpbs&r=http://www.pinoy-ako.info/movies/pinoy-movies-uploaded.html&kw='watch filipino channel', 'pinoy channel', 'philippine basketball association, 'watch nba', 'radio p/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CL7gg62Ww4X0EBACGKH39b6X1YWcbCINODcuMjMxLjIyMC4zNygBMNqmw5gF&ti2=2076774&ti3=${APN}

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=ams1CN--wMON5r3aBBACGKbgi6WZ26z0dyIMODguMTg3LjMuMjQ3KAEwtZ_JmAU.&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CN--wMON5r3aBBACGKbgi6WZ26z0dyIMODguMTg3LjMuMjQ3KAEwtZ_JmAU.&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?syYW-Ipuxz-zJhb4im7HPwAAAAAAAPg_syYW-Ipuxz-zJhb4im7HPybwopTZsuh3Xx9w2DD3tAS1TxJTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAgcgAAgQCAQIAAIoA-CXY4gAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=101,298&clientId=d755964c-81a8-41a8-b13d-574d43183117&l=http://www.megacinema.fr/sexy-a-tout-prix-play/?ptn=cashtrafic&t2c=a0a1197b00852819f5811254d54814037559&utm_source=157&utm_medium=1-3&utm_campaign=8267-1&utm_term=13540&utm_content=52676&subid=14886512551393708970&r=http://www.adcash.com/script/pop_packcpm.php?k=53124fa9d7fa9320641.504693&h=d14d2b6e99f833667f86fd765e5142b3c5fb6162&id=0&ban=320641&r=195299&ref=h&data=&subid=&new=1/clickenc=http://www.hdplugindownload.c

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=fra1CN--wMON5r3aBBACGJWGjcK9tpPvDiIMODguMTg3LjMuMjQ3KAEwkui-mAU.&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CN--wMON5r3aBBACGJWGjcK9tpPvDiIMODguMTg3LjMuMjQ3KAEwkui-mAU.&ti2=2076774&ti3=${APN}

http://fra1.ib.adnxs.com/click?yGEwf4XM4z_IYTB_hczjPwAAAAAAAPg_yGEwf4XM4z_IYTB_hczjPxVDQ9izTd4OXx9w2DD3tAQStA9TAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAA4wAAgQCAQIAAIoAviQQ0wAAAAA./cnd=!0wYdPwjdg7gBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=291&clientId=d755964c-81a8-41a8-b13d-574d43183117&l=http://gofirstrow.eu/watch/242880/1/watch-sl-benfica-vs-paok-saloniki.html&r=http://gofirstrow.eu/&kw=SL Benfica vs PAOK Saloniki,, free streams,live video online, live stream, online stream, online tv, watch, streaming, free/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CN--wMON5r3aBBACGJWGjcK9tpPvDiIMODguMTg3LjMuMjQ3KAEwkui-mAU.&ti2=2076774&ti3=${APN%

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=fra1CIqo-6uBlcHbEhACGLyJ6YS-ueCFPiINOTAuNTQuMjI1LjExNygBMPPAxpgF&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CIqo-6uBlcHbEhACGLyJ6YS-ueCFPiINOTAuNTQuMjI1LjExNygBMPPAxpgF&ti2=2076774&ti3=${APN}

http://fra1.ib.adnxs.com/click?qFfKMsSx8z-oV8oyxLHzPwAAAAAAAPg_qFfKMsSx8z-oV8oyxLHzP7xEmuDLgQs-CtR-FagEtxJzoBFTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAA2csAAgQCAQIAAIoAbyfWmAAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=103,234&clientId=7a09cfcb-8021-4f0d-a69a-6460c26fd4db&l=http://safeshare.tv/w/IpuKXDgSjv&r=/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1CIqo-6uBlcHbEhACGLyJ6YS-ueCFPiINOTAuNTQuMjI1LjExNygBMPPAxpgF&ti2=2076774&ti3=${APN}

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=ams1CMrWuaeT5KOBQxACGLfGwrGB2fOaSCILOTIuOTUuNDAuMzgoATDow8KYBQ..&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMrWuaeT5KOBQxACGLfGwrGB2fOaSCILOTIuOTUuNDAuMzgoATDow8KYBQ..&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?kWPrGcKx6z-RY-sZwrHrPwAAAAAAAPg_kWPrGcKx6z-RY-sZwrHrPzejMBbIzjVISmvuNCGPAkPooRBTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAATsAAgQCAQIAAIoAUiUXNgAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=291&clientId=4a03efb9-bb84-436e-8835-da9fbb2e14e3&l=http://www.lebuteur.com/en/actualites/jardim-ent-sporting-lisbonne-slimani-merite-ma-confiance-cest-mon-choix-n°1-contre-braga&r=http://www.lebuteur.com/&kw=le buteur, football, Algérien, International, actulités, Leonardo Jardim,Islam Slimani., E.N., football, foot, algérie/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMrWuaeT5KOBQxACGLfGwrGB2

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=ams1CMrWuaeT5KOBQxACGIvOsuOTpvvQGCILOTIuOTUuNDAuMzgoATCN9r2YBQ..&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMrWuaeT5KOBQxACGIvOsuOTpvvQGCILOTIuOTUuNDAuMzgoATCN9r2YBQ..&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?p60RwTi48z-nrRHBOLjzPwAAAAAAAPg_p60RwTi48z-nrRHBOLjzPwunbDwx7aEYSmvuNCGPAkMNew9TAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAUmcAAgQCAQIAAIoAlyN_dAAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=28&clientId=4a03efb9-bb84-436e-8835-da9fbb2e14e3&l=http://www.airalgerie.dz/&r=https://www.google.fr//clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMrWuaeT5KOBQxACGIvOsuOTpvvQGCILOTIuOTUuNDAuMzgoATCN9r2YBQ..&ti2=2076774&ti3=${APN}

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=ams1CMPh-_Keq-SjTxACGKzom9Obn4e2UyINODIuMjM0LjIxLjExNigBMPLCwpgF&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMPh-_Keq-SjTxACGKzom9Obn4e2UyINODIuMjM0LjIxLjExNigBMPLCwpgF&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?hv90AwXexz-G_3QDBd7HPwAAAAAAAPg_hv90AwXexz-G_3QDBd7HPyz0Zrr5HGxTw_Be7lmRR09yoRBTAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAv7kAAgQCAQIAAIoA7CVV1gAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=21&clientId=b9397f84-d0cd-4503-a7ef-3942b09fc0b8&l=http://www.grainedecurieux.fr/bebe/eveil-et-developpement-de-bebe/Pages/Des_jouets_pour_bien_grandir_10_a_18_mois.aspx&r=http://www.eveiletjeux.com/0-a-2-ans/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1CMPh-_Keq-SjTxACGKzom9Obn4e2UyINODIuMjM0LjIxLjExNigBMPLCwpgF&ti2=2076774&ti3=${APN}

http://ams1.ib.adnxs.com/click?4V6Zt-q67D_hXpm36rrsPwAAAAAAAPg_4V6Zt-q67D_hXpm36rrsP2qr9AeUb0JP51qrUZMvBwKmlg9TAAAAAGawHwB2AgAAdgIAAAIAAAA2IrIA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAAOGoAAgQCAQIAAIoAfSgUmQAAAAA./cnd=!zAaHQAjI-q8BELbEyAUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=21&clientId=40026d9c-f0cc-4e37-b0fc-4dcfe53edda8&l=http://www.jeu-a-telecharger.com/multi_wbml_v2/?ext_code=Bing-c-7346464111-p-3955822315&r=http://start.mysearchdial.com/results.php?f=4&q=telecharger le jeu question pour un champion gratuitement&a=irmsd0103&cd=2XzuyEtN2Y1L1Qzu0A0CzztCtCtB0CtByB0BzzyD0EtC0F0AtN0D0Tzu0SyByBtCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=460565431&ir=/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=ams1COe1rY218suDAhACGOrW0r_A8puhTyINOTIuMTM5LjEyMi42NigBMKatvpgF&ti2=2076774&ti3=${APN}

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=4743&ti1=lax1CKOrvOLWv8fSWRACGIi-7db8uvPgZiIOMjAwLjIwNy42Ni4xMTgoATCDjMaYBQ..&iaff1=9886&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&iaff1=9886&ci=4743&capp=FlashPlayer&ti1=lax1CKOrvOLWv8fSWRACGIi-7db8uvPgZiIOMjAwLjIwNy42Ni4xMTgoATCDjMaYBQ..&til2=2136230&til3=${APN}

http://lax1.ib.adnxs.com/click?LWACt-7m0D8tYAK37ubQP3e-nxov3eQ_LWACt-7m0D8tYAK37ubQPwhf28rXzcFmoxVPbP0dpVkDhhFTAAAAAKaYIAB2AgAAdgIAAAIAAACM9akAUGYFAAAAAQBVU0QAVVNEACwB-gB7OwAAZMIAAgQCAQIAAIwAuSi0QwAAAAA./cnd=!ZgYOPAjEucABEIzrpwUY0MwVIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=107,212&clientId=undefined&l=http://www.artinvitte.com.br/detalhes-de-convites-casamentos-e-festas/tipos-de-frases-para-convites.htm&r=https://www.google.com.br/&kw=art,invitte,artinvitte,convites,casamento,15 anos,bodas,noivas,debutante,noivado,envelope,relevo,mon/clickenc=http://.../direct-download.html?version=1.1.1.72&iaff1=9886&ci=4743&capp=FlashPlayer&ti1=lax1CKOrvOLWv8fSWRACGIi-7db8uvPgZiIOMjAwLjIwNy42Ni4xMTgoATCDjMaYBQ..&til2=2136230&til3=${APN}

http://www.detaileddownload.com/download.php?version=1.1.1.72&direct=1&prefix=FlashPlayersetup&campid=5221&ti1=fra1COHw_56cr_LGAhACGOWrnMjhx4mfMSILMzEuMzUuNS4xOTUoATCwlr6YBQ..&ti2=2076774&ti3=${APN}&capp=FlashPlayer

http://www.hdplugindownload.com/direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1COHw_56cr_LGAhACGOWrnMjhx4mfMSILMzEuMzUuNS4xOTUoATCwlr6YBQ..&ti2=2076774&ti3=${APN}

http://fra1.ib.adnxs.com/click?L00R4PRu8z8vTRHg9G7zPwAAAAAAAPg_L00R4PRu8z8vTRHg9G7zP-UVBxk-Jj4xYfjfw3nJjQIwiw9TAAAAAGawHwB2AgAAdgIAAAIAAABopLwA1ioFAAAAAQBVU0QAVVNEACwB-gBG0AAApIwAAgQCAQIAAIoA4SNgOwAAAAA./cnd=!xwYjPgiLybgBEOjI8gUY1tUUIAM./referrer=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=20,101&clientId=755526fe-38c5-45aa-9989-6eff0548bb3b&l=http://www.pokerstars.fr/gratuits/daily-freerolls/&r=http://www.pokerstars.fr/tournois//clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5221&capp=FlashPlayer&ti1=fra1COHw_56cr_LGAhACGOWrnMjhx4mfMSILMzEuMzUuNS4xOTUoATCwlr6YBQ..&ti2=2076774&ti3=${APN}

Latest 30 of 40 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove launcher__3338_i395140339_il689050.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.