home

launcher__4529_i340240650_il44935.exe

Installer

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application launcher__4529_i340240650_il44935.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup.
Publisher:
Amônétízé Ltd  (signed by Shetef Solutions & Consulting (1998) Ltd.)

Product:
Installer

Version:
1.1.5.98

MD5:
4969533d01248ba4303f53fed81eb678

SHA-1:
4dea8507e508a4e045e48f7b5fa2c1a8dc8318cd

SHA-256:
c1e2fd84e99903edc75e703d82f212c4b8c0fa910719c555a8ebbe2c423aa810

Scanner detections:
13 / 68

Status:
Adware

Explanation:
Uses the InstallMonetizer distribution platform to bundle adware.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/25/2024 12:54:31 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.02.09

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.130.78

AVG
Generic_r
2015.0.3566

Comodo Security
ApplicUnwnt
17758

ESET NOD32
Win32/Amonetize.AD (variant)
8.9400

Fortinet FortiGate
Riskware/Amonetize
2/12/2014

IKARUS anti.virus
not-a-virus:Downloader.Win32.Agent
t3scan.2.2.29

Malwarebytes
PUP.Optional.InstallMonetizer
v2014.02.12.02

McAfee
Artemis!4969533D0124
5600.7222

Qihoo 360 Security
HEUR/Malware.QVM01.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.ShetefSolutionsConsulting1998.b
14.8.8.3

Trend Micro House Call
TROJ_GEN.F47V0206
7.2.43

VIPRE Antivirus
Amonetize
26296

File size:
150.1 KB (153,728 bytes)

Product version:
2.1.12

Copyright:
(c) Amônétízé Ltd, 2012,2013. All rights reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\launcher__4529_i340240650_il44935.exe

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Authority:
Thawte, Inc.

Valid from:
7/23/2013 4:00:00 AM

Valid to:
7/24/2014 3:59:59 AM

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7C23DBB97FAFBB9D28D413F836202024

File PE Metadata
Compilation timestamp:
2/6/2014 6:50:12 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:ZAgVnOGmMnzbRT0EAbm1azdqER8MfUZHmi6y5uJOUDznBcvx:ZrnE8z6EAS1aJqEeMfUZGi1u8CzBix

Entry address:
0x59D70

Entry point:
60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Code size:
128 KB (131,072 bytes)

The file launcher__4529_i340240650_il44935.exe has been seen being distributed by the following 2 URLs.

http://www.prudentdownload.com/download.php?version=1.1.5.98&campid=4798&instid[appname]= Flappy Bird&instid[appsetupurl]=http://instagaming.org/amonetize/.../FlappyBird_setup.exe&instid[cmdline]=&instid[appimageurl]=http://instagaming.org/amonetize/.../flappybird.jpg&prefix=FlappyBirdSetup&instid[thankyoupage]=

http://download1135.mediafire.com/cj662u6fe7og/.../Flappy bird hack 2014__5939_il2532512.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove launcher__4529_i340240650_il44935.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.