home

qtypesetup.exe

eDownload Module

Banyan Tree Technology Limited

The application qtypesetup.exe by Banyan Tree Technology Limited has been detected as adware by 18 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. This is an adware bundler (AKA ElexNetDownload) that will include additional unwanted offers in the download and install process. During install it will establish a connection to twonext.com and xingcloud.com to determine what offers to show the user (based on what is already installed and where they live).
Publisher:
Banyan Tree Technology Limited  (signed and verified)

Product:
eDownload Module

Version:
5.1.8.2370

MD5:
985feae2564ba3cd8228d02cb782ea55

SHA-1:
58f58d82a66a5a4f39fd9341589cbfcbfbc8c434

SHA-256:
3365fb3bd5c1fc89eadf9cc31861f885df59478b0eed6679ef997eecd5297701

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Software bundler and update mechanism that will attempt to install adware offers.

Analysis date:
4/24/2024 9:36:37 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Strictor.64090
453

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.200.24

avast!
Adware-BEN [Adw]
2014.9-151109

AVG
Generic
2016.0.2931

Baidu Antivirus
Adware.Win32.ElexInstall
4.0.3.15119

Bitdefender
Gen:Variant.Adware.Strictor.64090
1.0.20.1565

Dr.Web
Adware.Mutabaha.43
9.0.1.0313

Emsisoft Anti-Malware
Gen:Variant.Adware.Strictor.64090
8.15.11.09.04

ESET NOD32
Win32/ELEX.C potentially unwanted application
9.7.0.302.0

F-Secure
Gen:Variant.Adware.Strictor.64090
11.2015-09-11_2

G Data
Gen:Variant.Adware.Strictor.64090
15.11.24

K7 AntiVirus
Unwanted-Program
13.190.14585

MicroWorld eScan
Gen:Variant.Adware.Strictor.64090
16.0.0.939

Norman
Gen:Variant.Adware.Strictor.64090
11.20151109

Qihoo 360 Security
Malware.QVM01.Gen
1.0.0.1015

Reason Heuristics
PUP.BanyanTreeTechnology.Installer (M)
15.11.9.4

Sophos
Virus 'Mal/Cleaman-B'
59

VIPRE Antivirus
Elex Installer
36480

File size:
300.6 KB (307,808 bytes)

Product version:
5.1.8.2370

Copyright:
Copyright 2013

Original file name:
eDownload.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\qtypesetup.exe

Digital Signature
Signed by:
Banyan Tree Technology Limited

Authority:
GlobalSign nv-sa

Valid from:
1/9/2013 11:18:54 PM

Valid to:
1/10/2015 11:18:54 PM

Subject:
CN=Banyan Tree Technology Limited, O=Banyan Tree Technology Limited, L=HongKong, S=HongKong, C=HK

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121C63E4490F9D28667737C8DE7D3B6805D

File PE Metadata
Compilation timestamp:
6/6/2013 9:25:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:GbKDArz9hE9T4xrsVPa1kFGhV0tMDNrLbr8PCMiZkDLwtwNqzrsr+:rkNqB4Ma1kFGmMx3f8j0QAwczrs

Entry address:
0xBE8B0

Entry point:
60, BE, 00, 70, 47, 00, 8D, BE, 00, A0, F8, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.8928

Packer / compiler:
UPX 2.90LZMA

Code size:
288 KB (294,912 bytes)

The file qtypesetup.exe has been seen being distributed by the following URL.

http://dl.elex.soft365.com/.../generator?short=spo_2004_7c08e9cbedc99259528bc0e0c647e969

Remove qtypesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.