» yontoosetup-silent.exe
Overview
Analysis
File Details
Downloads (1)

yontoosetup-silent.exe

Yontoo

Yontoo LLC

This is the installer/setup program for a Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application yontoosetup-silent.exe by Yontoo has been detected as adware by 12 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.kbm2.com.

File name:

Publisher:

Yontoo LLC (signed and verified)

Product:

Yontoo

Description:

Installer

Version:

2012.5.11.1459

MD5:

8398a8fdf7d0018b714f164642984026

SHA-1:

1d3e166a639b18eac630d9e92038d665053b6eb1

SHA-256:

38a1e46c7fe778b1538046870c46734d8fe659bd0ab9e535821b9c9882b58919

Scanner detections:

12 / 68

Status:

Adware

Explanation:

Belongs to the Sambreel/Yontoo progam that inserts various forms of advertising in the user's web browser, installed with minimal or no user consent.

Analysis date:

4/25/2024 8:55:05 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Adware.Yontoo

7.1.1

Avira AntiVirus

ADWARE/Yontoo.Gen

7.11.153.238

Baidu Antivirus

Trojan.Win32.Adware

4.0.3.14720

Boost by Reason

Optional.Yontoo.S

188838

Comodo Security

Heur.Suspicious

18486

Dr.Web

Adware.Siggen.24249

9.0.1.0201

ESET NOD32

Win32/Adware.Yontoo (variant)

8.9914

Fortinet FortiGate

Riskware/Yontoo

7/20/2014

IKARUS anti.virus

AdWare.Yontoo

t3scan.1.6.1.0

NANO AntiVirus

Trojan.Html.Plugin.bopldg

0.28.0.60100

Reason Heuristics

PUP.Installer.Yontoo.S

14.8.7.17

VIPRE Antivirus

Yontoo

30108

File size:

1 MB (1,051,040 bytes)

Product version:

1.10.02

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\yontoosetup-silent.exe

Digital Signature

Signed by:

Yontoo LLC

Authority:

VeriSign, Inc.

Valid from:

12/6/2011 6:00:00 PM

Valid to:

12/6/2012 5:59:59 PM

Subject:

CN=Yontoo LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Yontoo LLC, L=Carlsbad, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

4F8617352536F013088C9B5533AA4440

File PE Metadata

Compilation timestamp:

3/10/2011 8:55:32 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

24576:8bfU+LJ9MBAMswkckLLrZKG5y4MjLB0Cx/V37CZdm6+pSfp7kOE6w3:B2JmiMELLEn42l0Cn7CZdOGoOEv

Entry address:

0x1627

Entry point:

55, 8B, EC, 81, EC, 58, 0B, 00, 00, 53, 56, 33, DB, 57, 66, 89, 9D, A8, F4, FF, FF, 89, 5D, FC, FF, 15, 74, 30, 40, 00, A3, 00, 40, 40, 00, FF, 15, 70, 30, 40, 00, 89, 45, F8, 8D, 85, B8, FC, FF, FF, 50, C7, 85, B8, FC, FF, FF, 14, 01, 00, 00, FF, 15, 6C, 30, 40, 00, 85, C0, 75, 21, FF, 15, 14, 30, 40, 00, 50, 68, 30, 34, 40, 00, E8, 40, FA, FF, FF, 59, C7, 05, 04, 40, 40, 00, FF, 00, 00, 00, E9, C5, 01, 00, 00, 68, 1C, 34, 40, 00, 68, 0C, 34, 40, 00, FF, 15, 68, 30, 40, 00, 50, FF, 15, 64, 30, 40, 00, 3B... 
[+]

Entropy:

7.9954

Developed / compiled with:

Microsoft Visual C++

Code size:

7.5 KB (7,680 bytes)

The file yontoosetup-silent.exe has been seen being distributed by the following URL.

http://dl.kbm2.com/download/.../20125111459.exe

Remove yontoosetup-silent.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.