» yontoo-c4.exe
Overview
Analysis
File Details

yontoo-c4.exe

DropDownDeals

Web Deals Interactive LLC

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser as well as modify the computer’s system settings that control applications to run on startup. Part of the Injekt brand of unwanted programs. The application yontoo-c4.exe by Web Deals Interactive has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software.

File name:

yontoo-c4.exe

Publisher:

Web Deals Interactive LLC (signed and verified)

Product:

DropDownDeals

Description:

Installer

Version:

2012.10.23.1815

MD5:

aeb17980b1864eb67beaa7bb6849fdd2

SHA-1:

9a1cad4697e29338f90e11c2fa1096a274a4662a

SHA-256:

defede09779673a8f975c27da2af6edb45a8bdb54a5a4bbb53ccdd315b010e0e

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:

4/25/2024 1:00:22 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Injekt (M)

17.1.23.9

File size:

1.2 MB (1,210,432 bytes)

Product version:

1.11.00

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\yontoo-c4.exe

Digital Signature

Signed by:

Web Deals Interactive LLC

Authority:

GoDaddy.com, Inc.

Valid from:

5/15/2012 3:41:08 PM

Valid to:

5/15/2013 12:52:46 PM

Subject:

CN=Web Deals Interactive LLC, O=Web Deals Interactive LLC, L=Carlsbad, S=CA, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2B7631E3D31FB1

File PE Metadata

Compilation timestamp:

3/10/2011 9:55:28 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

Entry address:

0x15B4

Entry point:

55, 8B, EC, 81, EC, CC, 05, 00, 00, 53, 56, 33, DB, 57, C6, 85, 34, FA, FF, FF, 00, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 00, 40, 40, 00, FF, 15, 70, 30, 40, 00, 89, 45, F8, 8D, 85, 3C, FE, FF, FF, 50, C7, 85, 3C, FE, FF, FF, 94, 00, 00, 00, FF, 15, 6C, 30, 40, 00, 85, C0, 75, 21, FF, 15, 14, 30, 40, 00, 50, 68, A8, 32, 40, 00, E8, 36, FA, FF, FF, 59, C7, 05, 04, 40, 40, 00, FF, 00, 00, 00, E9, 20, 02, 00, 00, 8B, 35, 68, 30, 40, 00, 68, 94, 32, 40, 00, 68, 84, 32, 40, 00, FF, D6, 50, FF, 15, 64, 30, 40... 
[+]

Entropy:

7.9969

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

Remove yontoo-c4.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.