home

uninstall182469281.exe

YourFile Downloader

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application uninstall182469281.exe by Via Advertising Group Limited has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dn.yourfiledownloader.com and multiple other hosts.
Publisher:
http://yourfiledownloader.com  (signed by Via Advertising Group Limited)

Product:
YourFile Downloader

Version:
1, 0, 0, 294

MD5:
23d3a26ba0fef0fa1409eaaf22e5bf9d

SHA-1:
60769e0e10a78f66ef1c8dec9fd20b948c280d39

SHA-256:
2b71090f50ab1e458f020e2878e16c5bdceafcad3ba54fdbb9a53d8e9176708f

Scanner detections:
7 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/22/2024 10:04:25 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Downloader-UEO [PUP]
2014.9-131229

ESET NOD32
Win32/YourFileDownloader (variant)
7.8732

herdProtect (fuzzy)
variant of uninstall2954627.exe (Adware)
2014.1.5.21

McAfee
Artemis!23D3A26BA0FE
5600.7266

Reason Heuristics
PUP.ViaAdvertisingGroupLimited.S
14.8.15.17

Trend Micro House Call
TROJ_GEN.F47V0812
7.2.363

VIPRE Antivirus
Via Advertising
20922

File size:
4.4 MB (4,656,816 bytes)

Product version:
1.0.1

Copyright:
Copyright http://yourfiledownloader.com (C) 2012

Original file name:
YourFile.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\uninstall182469281.exe

Digital Signature
Signed by:
Via Advertising Group Limited

Authority:
COMODO CA Limited

Valid from:
4/12/2013 3:00:00 AM

Valid to:
4/12/2016 2:59:59 AM

Subject:
CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BABC309174F531C6762BBA466401FEAF

File PE Metadata
Compilation timestamp:
8/12/2013 5:02:29 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:zcnBdOt9EWJ4jfbY5tCEe4pEc/qyx8X6LL9:B9pJ4jTY5tve4pEcwXY

Entry address:
0xE116

Entry point:
E8, AA, 6B, 00, 00, E9, 89, FE, FF, FF, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, B7, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 47, 08, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 90, E2, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, A4, E1...
 
[+]

Entropy:
7.8661  (probably packed)

Code size:
110 KB (112,640 bytes)

The file uninstall182469281.exe has been seen being distributed by the following 9 URLs.

http://dn.yourfiledownloader.com/j5GiUnaQvEsm26Mfa5ijLGHR9TUyq7wner37OHehhW4p/.../IVgHXz14D3MlWCg==

http://dn.yourfiledownloader.com/j5GCVnDUrFV23KRTY9nxJ2vPvCB8patrZrayb2qkxyRzpYFqFeDafVWhjyhHsZVeF TNUwDGjRgL1c5YDN05SgzeMA==

http://dn.yourfiledownloader.com/.../8MkV7KeNk w0GYT68ZTCKiGWgPTzl0F08lXDdA=

http://dn.yourfiledownloader.com/j5GKWW7J53xp0ON5Zcq2KnjZpmkg8Oh4NpOYDUihkXNGmowTArqcPEGnwz5csdcUQ7WRWgXQyk1FkZ8YV4FlTgfUPUV61n0Ie8U SHzMKLV2yCc=

http://dn.yourfiledownloader.com/j5GrWnbZp0J 2aEfbtS9ZXnRvCMv9 l4MLeoLW2liDcj9dxkFeDPL1Xp3Gwd7slVHuXBVQ==

http://dn.yourfiledownloader.com/.../oYOR7jIUALT3xhDhooCU4w8QgzUIwMxzThIccI1Rn7KJbU=

http://dn.yourfiledownloader.com/j5GhUmPUpVpo0L4fbdC MHqcoShlrqprZqC7aW2liDcj 9VkBKOcOVG5hDsX4chRG XTE0HdyFgB0sRfDdE5Rg==

http://dn.yourfiledownloader.com/j5GAWWXGoF5xlJ1eadOwJGuckSJhqb4lc7b9DGipgjg4u4g Ru3eaxXynipIr5wKSuHMXgLYwE1Cl8BeCd83RAjVNUd0

http://dn.yourfiledownloader.com/j5HyF2bRsEgmwKIfbtG0ZXnRvCMv9 l4MLeoLW2liDcj9dxkFeDPL1Xp3Gwd78BTHurNVA==

Remove uninstall182469281.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.