softonicdownloader_voor_avg-antivirus-free-2014.exe

Softonic Downloader

Softonic International

This is the Download Manager localized to Spanish that bundles the original software from the Softonic.com web site along with additional offers, mostly ad-supported browser extensions and utilities. While the original product is most likely clean, the Softonic Downloader is considered a PUP. The application softonicdownloader_voor_avg-antivirus-free-2014.exe by Softonic International has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the Softonic Downloader installer. According to AVG, this software downloads additional adware offers during setup.
Publisher:
Softonic  (signed by Softonic International)

Product:
Softonic Downloader

Version:
1.41.2.2

MD5:
5ee00e9d33244898834699740d764c68

SHA-1:
c0c23d3fb94d8671d0e767e637580df9e2bcc1bf

SHA-256:
4dbf1370fb7274c639cd9e54ba27cc2b35ddf4f3213c7ada62fc36bd65ea339c

Scanner detections:
24 / 68

Status:
Adware

Explanation:
Softonic Downloader is a download and install manager that provides users to the Softonic web site the ability to download 3rd-party software. During the installation the installer will show sponsored offers such as adware type toolbars and web browser extensions as well as other potentially unwanted applications. This type of software is typically known as an adware co-bundler. The downloader does not modify the original software.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
10/21/2017 11:27:28 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Downloader
7.1.1

Antiy Labs AVL
GrayWare[Downloader:not-a-virus]/Win32.Agent.bxib
1.0.0.1

AVG
Skodna.Downloader
2015.0.3386

Baidu Antivirus
Adware.Win32.SoftonicDownloader
4.0.3.14810

Comodo Security
Application.Win32.Agent.SOFE
18059

Dr.Web
Adware.Downware.5743
9.0.1.0222

ESET NOD32
Win32/SoftonicDownloader.G potentially unwanted application
8.7.0.302.0

Fortinet FortiGate
Riskware/Agent
8/10/2014

F-Prot
W32/Softonic.C2.gen
v6.4.7.1.166

IKARUS anti.virus
PUA.Softonic
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.180.12719

K7 Gateway Antivirus
Unwanted-Program
13.180.12719

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3427

Kingsoft AntiVirus
Win32.Troj.DownAgent.bx.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.Softonic.A
v2014.08.10.01

McAfee
Artemis!5EE00E9D3324
5600.7042

McAfee Web Gateway
Artemis!5EE00E9D3324
7.7042

NANO AntiVirus
Trojan.Win32.Agent.dchxde
0.28.2.60990

Reason Heuristics
Bundler.PPI.Softonic.p
14.8.10.13

Rising Antivirus
PE:Malware.Obscure/Heur!1.9E03
23.00.65.14808

SUPERAntiSpyware
Adware.Softonic/Variant
10430

Trend Micro House Call
Suspicious_GEN.F47V0717
7.2.222

VIPRE Antivirus
Threat.4786139
31208

File size:
351.9 KB (360,304 bytes)

Product version:
1.41.2.2

Copyright:
Copyright (C) 2014

Original file name:
SoftonicDownloader.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softonic Downloader

Language:
Spanish

Common path:
C:\users\{user}\downloads\softonicdownloader_voor_avg-antivirus-free-2014.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
7/3/2013 2:00:00 AM

Valid to:
10/3/2015 1:59:59 AM

Subject:
CN=Softonic International, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Softonic International, L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
67C1FF44C765ABDA26027A6DCA52BA11

File PE Metadata
Compilation timestamp:
7/2/2014 11:24:14 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:RUGz732v6BPheasw5lBZUapTy7UG8FJjSjSca5/u2hZembKeXiPonKN/WV9OoS3L:RJ7GkDswBZb+7UG4EjYutmbKeXQsZOoC

Entry address:
0xF1740

Entry point:
60, BE, 00, 50, 4A, 00, 8D, BE, 00, C0, F5, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, ED, F8, 0E, 00, 57, 83, C3, 04, 53, 68, 31, C7, 04, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
312 KB (319,488 bytes)

The file softonicdownloader_voor_avg-antivirus-free-2014.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to static.sd.softonic.com  (46.28.209.70:80)

TCP (HTTP):
Connects to screenshots.com.sftcdn.net  (46.28.209.55:80)