» qtypesetup.exe
Overview
Analysis
File Details
Downloads (1)

qtypesetup.exe

eDownload Module

Banyan Tree Technology Limited

The application qtypesetup.exe by Banyan Tree Technology Limited has been detected as adware by 10 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This is an adware bundler (AKA ElexNetDownload) that will include additional unwanted offers in the download and install process. During install it will establish a connection to twonext.com and xingcloud.com to determine what offers to show the user (based on what is already installed and where they live).

File name:

qtypesetup.exe

Publisher:

Banyan Tree Technology Limited (signed and verified)

Product:

eDownload Module

Version:

5.1.8.2217

MD5:

7867a8774b7f4fe22436592368339cf2

SHA-1:

46d08d7d6b9519a9c8c819345e4ac20415fa5dd3

SHA-256:

58a2f93f930a89a29ab7b69afcf177b28a7e7718d825f1858e1b7b7c1c01ce94

Scanner detections:

10 / 68

Status:

Adware

Explanation:

Software bundler and update mechanism that will attempt to install adware offers.

Analysis date:

4/25/2024 9:43:12 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.146.188

avast!

Win32:Adware-BEN [Adw]

2014.9-140501

AVG

MalSign.Generic

2015.0.3487

Baidu Antivirus

Adware.Win32.ElexInstall

4.0.3.1451

Dr.Web

Adware.Mutabaha.43

9.0.1.0121

ESET NOD32

Win32/ELEX (variant)

8.9746

G Data

Win32.Adware.Elex

14.5.24

Qihoo 360 Security

Malware.QVM01.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.BanyanTreeTechnologyLimited.K

14.5.1.14

VIPRE Antivirus

Elex Installer

28756

File size:

261.6 KB (267,872 bytes)

Product version:

5.1.8.2217

Original file name:

eDownload.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\qtypesetup.exe

Digital Signature

Signed by:

Banyan Tree Technology Limited

Authority:

GlobalSign nv-sa

Valid from:

1/9/2013 11:18:54 PM

Valid to:

1/10/2015 11:18:54 PM

Subject:

CN=Banyan Tree Technology Limited, O=Banyan Tree Technology Limited, L=HongKong, S=HongKong, C=HK

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C63E4490F9D28667737C8DE7D3B6805D

File PE Metadata

Compilation timestamp:

3/29/2013 1:29:56 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:CMLUUGWkbJB5dVoa2EJTNDV9k4ohdP3T3a7PRwO0xxc:RsJBHVoa2ERNUhZSRwc

Entry address:

0xB3D80

Entry point:

60, BE, 00, 60, 47, 00, 8D, BE, 00, B0, F8, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.8993

Packer / compiler:

UPX 2.90LZMA]

Code size:

248 KB (253,952 bytes)

The file qtypesetup.exe has been seen being distributed by the following URL.

http://dl.elex.soft365.com/.../generator?short=gls_1530_b73b79cf7839ac14fd569f70b971fb03

Remove qtypesetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.