home

santa+cruz+skateboard+log_10924_i90472274_il345.exe

WinAce

KASHTAN OOO

The application santa+cruz+skateboard+log_10924_i90472274_il345.exe, “http://www.winace.com” by KASHTAN OOO has been detected as a potentially unwanted program by 8 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
e-merge GmbH  (signed by KASHTAN OOO)

Product:
WinAce

Description:
http://www.winace.com

Version:
2.69.0.0

MD5:
4326465de75864a4c4fedbfbf7f7f6fe

SHA-1:
bdc243f2c587ddb5f32ca12f19246afb23520df6

SHA-256:
1101d4f2f19d6d70057c1247560d4af61f2b90634dbea079d377d1eb4a2bd888

Scanner detections:
8 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 2:09:07 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Win32/DH{PXIx?}
2016.0.2913

Bkav FE
W32.HfsAdware
1.3.0.7383

Dr.Web
Trojan.Amonetize.11197
9.0.1.0331

ESET NOD32
Win32/Amonetize.LM potentially unwanted (variant)
9.12626

NANO AntiVirus
Trojan.Win32.Amonetize.dytuks
0.30.26.4751

Qihoo 360 Security
HEUR/QVM19.1.Malware.Gen
1.0.0.1077

Reason Heuristics
PUP.KASHTAN (M)
15.11.27.8

Vba32 AntiVirus
Signed-Downware.Amonetize
3.12.26.4

File size:
3.4 MB (3,610,512 bytes)

Product version:
02.69.00.00

Copyright:
1997-2007 ACE Compression Software & e-merge GmbH

Trademarks:
1997-2007 ACE Compression Software & e-merge GmbH

File type:
Executable application (Win32 EXE)

Language:
German (Germany)

Common path:
C:\users\{user}\downloads\santa+cruz+skateboard+log_10924_i90472274_il345.exe

Digital Signature
Signed by:
KASHTAN OOO

Authority:
Thawte, Inc.

Valid from:
7/4/2015 8:00:00 PM

Valid to:
5/21/2016 7:59:59 PM

Subject:
CN=KASHTAN OOO, O=KASHTAN OOO, L=Naberezhnye Chelny, S=Tatarstan republic, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
468BE39F7FCABE2D4D2D070862DD916B

File PE Metadata
Compilation timestamp:
11/26/2015 4:12:49 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:h/BOa12xrZHRHo2mXyi0wyljE+CNlaYzG/Enz5:h/BOa12xjo2mXFc4FlxzDn1

Entry address:
0x357262

Entry point:
68, 59, 01, 1D, 00, E8, D3, 21, FE, FF, 86, EA, 92, AD, AE, 2E, E8, F2, E3, CC, A1, 5A, 42, DB, BA, 90, 0B, 5E, 97, BC, 4F, BF, BB, 62, F8, 1B, 4A, 05, 3E, 5B, 66, 8B, CE, F3, 51, F3, 58, DC, 26, 09, 1F, 9A, CD, 4F, 60, 6E, AD, C7, 07, 4D, 18, D4, 89, 27, 9B, B7, 75, 51, DA, D0, 33, 68, 12, 06, 1B, 12, 40, 27, 94, 95, 37, 8C, C3, A0, 23, A0, DC, 56, C0, AD, 12, 42, DB, 9E, 1E, 06, 1B, 2C, B4, CE, FB, F2, 40, 1D, F3, 1A, 11, 7B, C3, 7E, 2F, 3A, 11, A1, D1, F1, 63, 76, 93, BF, 9E, 79, AB, 86, 36, 84, FF, 6E...
 
[+]

Entropy:
7.5789

Code size:
3 MB (3,117,056 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.