home

yet_another_cleaner_sk.exe

yacdl

Elex do Brasil Participações Ltda

The application yet_another_cleaner_sk.exe, “standard installer” by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.yac.mx and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
yacdl

Description:
standard installer

Version:
1.0.75.19786

MD5:
fa32843de66e514b0668c7ff8a5472f2

SHA-1:
a91bb2572f8cfd46a9f9cc815201c26d5b7e28de

SHA-256:
8cb9bbeae160c900a1b6a40cb66b9c0f17962e15ff6e89b7c47108d5cc4dce9d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/16/2024 5:04:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.Installer.W
14.12.11.15

File size:
764.7 KB (783,096 bytes)

Product version:
1.0.75.19786

Copyright:
Copyright 2011-2014 Elex do Brasil Participações Ltda. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_sk.exe

Digital Signature
Signed by:
Elex do Brasil Participações Ltda

Authority:
VeriSign, Inc.

Valid from:
6/23/2014 1:00:00 AM

Valid to:
6/21/2015 12:59:59 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=São Paulo, S=São Paulo, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5C6950D0A05A1CD63164D1E1EB1FFB8A

File PE Metadata
Compilation timestamp:
3/22/2010 12:59:04 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:Jc/tb3x3PQJYlbG6/ZEkJXJM8ZSHufllTQmUMlkN870vNpQHkMMiRDapybXA9MSp:2VbhsYlbd/ZEkfM6csf/DkA0Tablkybg

Entry address:
0x114F

Entry point:
E9, AC, 55, 00, 00, E9, C7, 94, 00, 00, E9, 12, 99, 00, 00, E9, 6D, 94, 00, 00, E9, 88, A9, 00, 00, E9, 63, B9, 00, 00, E9, FE, 99, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
57 KB (58,368 bytes)

The file yet_another_cleaner_sk.exe has been seen being distributed by the following 40 URLs.

http://www.yac.mx/.../114879

http://www.yac.mx/.../772324

http://www.yac.mx/.../6148877

http://www.yac.mx/.../5506366

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_2999144.exe

http://www.yac.mx/.../2999144

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_4002274.exe

http://www.yac.mx/.../4002274

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_2377353.exe

http://www.yac.mx/.../2377353

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_6546811.exe

http://www.yac.mx/.../6546811

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_4575201.exe

http://www.yac.mx/.../4575201

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_786844.exe

http://www.yac.mx/.../786844

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_5053901.exe

http://www.yac.mx/.../5053901

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_5312386.exe

http://www.yac.mx/.../5312386

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_606811.exe

http://www.yac.mx/.../606811

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_6083180.exe

http://www.yac.mx/.../6083180

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_5726941.exe

http://www.yac.mx/.../5726941

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_42219.exe

http://www.yac.mx/.../42219

http://dl2.yac.mx/download/.../yet_another_cleaner_sk_5866179.exe

http://www.yac.mx/.../5866179

Latest 30 of 40 download URLs

Remove yet_another_cleaner_sk.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.