home

uninstall2954627.exe

YourFile Downloader

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application uninstall2954627.exe by Via Advertising Group Limited has been detected as adware by 28 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
http://yourfiledownloader.com  (signed by Via Advertising Group Limited)

Product:
YourFile Downloader

Version:
1, 0, 0, 294

MD5:
96d1cd5e0aca0df12abb830b262e9d4d

SHA-1:
1d5b7e3da8f3f6bfd8b428c052ad434fe2e08bcc

SHA-256:
ff1a23f724921756e16ed9d634d9949e0cef69a56c41818f0db85a73de9c92c3

Scanner detections:
28 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/19/2024 9:40:07 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Generic.601634
1135

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.142.214

avast!
Win32:Downloader-UEO [PUP]
2014.9-131227

AVG
BundleApp_r.B
2015.0.3354

Bitdefender
Adware.Generic.601634
1.0.20.1805

Bkav FE
W32.Clod108.Trojan
1.3.0.4613

Comodo Security
Application.Win32.YourFileDownloader.~A
17217

Dr.Web
Adware.Downware.1451
9.0.1.0361

Emsisoft Anti-Malware
Adware.Generic.601634
8.13.12.27.06

ESET NOD32
Win32/ExpressDownloader (variant)
7.9282

Fortinet FortiGate
Adware/Fam.NB
12/27/2013

F-Secure
Adware.Generic.601634
11.2013-27-12_6

G Data
Adware.Generic.601634
13.12.22

herdProtect (fuzzy)
variant of uninstall19152102.exe (Adware)
2014.1.5.17

IKARUS anti.virus
PUA.ExpressDownloader.I
t3scan.1.6.1.0

K7 AntiVirus
Riskware
13.175.10814

Malwarebytes
PUP.Optional.YourfileDownloader
v2013.12.27.06

McAfee
Artemis!96D1CD5E0ACA
5600.7269

MicroWorld eScan
Adware.Generic.601634
14.0.0.1083

NANO AntiVirus
Riskware.Win32.Amonetize.cvaajw
0.28.0.59048

Reason Heuristics
PUP.ViaAdvertisingGroupLimited.Q
14.8.15.17

Rising Antivirus
PE:Malware.Adware!6.14A5
23.00.65.14909

Sophos
YourFile Downloader
4.98

Trend Micro House Call
TROJ_SPNV.03JG13
7.2.361

Trend Micro
TROJ_SPNR.3AJH13
10.465.27

VIPRE Antivirus
Via Advertising
25390

XVirus List
Win32.Detected
2.8.15

File size:
4.3 MB (4,556,464 bytes)

Product version:
1.0.1

Copyright:
Copyright http://yourfiledownloader.com (C) 2012

Original file name:
YourFile.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\uninstall2954627.exe

Digital Signature
Signed by:
Via Advertising Group Limited

Authority:
COMODO CA Limited

Valid from:
4/12/2013 2:00:00 AM

Valid to:
4/12/2016 1:59:59 AM

Subject:
CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BABC309174F531C6762BBA466401FEAF

File PE Metadata
Compilation timestamp:
8/22/2013 6:16:55 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:NanBdOt9EWJ4jfbY5tCEcs+pEc/qyx8X6LLk:x9pJ4jTY5tvcs+pEcwXB

Entry address:
0xE0F4

Entry point:
E8, AC, 6B, 00, 00, E9, 89, FE, FF, FF, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, B7, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 47, 08, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 70, E2, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85...
 
[+]

Entropy:
7.8616  (probably packed)

Code size:
110 KB (112,640 bytes)

The file uninstall2954627.exe has been seen being distributed by the following 10 URLs.

http://dn.yourfiledownloader.com/j5GgW2Pe6Vhg1e1Tb860Ly6N9SJ pa8ueLC1b3KnlCE q5A RrXPLEu9iWId6MNFXamXEF JnVYP3c5cCc51AAPdNkB7wzpDf8Y

http://dn.yourfiledownloader.com/j5GCWG3U6Wxv2KEfQs2/.../ySC2ag==

http://dn.yourfiledownloader.com/j5GkVGHfvFVy3aNYKsy0O3qctCl24LoqZaGubyv7lTs qYE VrmGNQakiTkEqpARCKuYDlbdzlsEwo4aWJ9sGlrRPE52wD5dMocwTnnPKbt6zSW ZA==

http://dn.yourfiledownloader.com/.../kKNpepKmrooyo n5EyUvCuLk wiH9et9E2QLiQFUGUmAVSjZMIGolvFx6vdxIjhGAVIdRLFiSZf AnnXmnAGVp5CRwbqktZUj3YzsVpURjXPkReUT7VyEIl14rVssbQ1KWRwJJ3EcZcoRHGnOHtQd

http://dn.yourfiledownloader.com/j5GoXmHCpkhp0rkfZd63Km3Z9XUi8eprZrayKX 7kjpxooQ7AqCFLlX0ji1Lu5oGSvyBD1fAiQJEhYkKGopgChibaB4mzT5LdNJ CiiPfOoqwSy ZjEprSJ3IL5pPxiibDsSoFM=

http://dn.yourfiledownloader.com/.../b9LGipgjg4u4g Ru3eaxTynipIr5wKSuHMXgbQzk1Cl8BeCd84RwvZM0Jx

http://dn.yourfiledownloader.com/j5GeYnHVu0gm16VQY9u0Hi7PsDVloaBmZqykPHOrkn54o5d6UbOAPkighCxeq9wCQLjYAlyHkAVTgY8cF9B1GxOJYR42mWYVa4diEz MeOwg0XjmPHV453t0eel3eEX1c2hK4Ax8D wLfUmiXSgDhR1pV9AfSV2WTx0Jn00ONcBDHXaAugR8gr8HdA==

http://dn.yourfiledownloader.com/j5GCXnDcuhtv2u13a8 wKmec GdXtrw5c7epbzKEiD53uIAzApWNMlK9gjED NlRHu3GThSXlAJS2cpfCM5yBlybaB4mzTBCc808WT6LLLJ9yy2 azMqvWc=

http://dn.yourfiledownloader.com/.../wS8PNck8TH3BJ7J5zyO2

http://dn.yourfiledownloader.com/.../wy8PNck8TH3BJ7J5zyKw

Remove uninstall2954627.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.