» yourfiledownloader0kvvv8aqe9.exe
Overview
Analysis
File Details

yourfiledownloader0kvvv8aqe9.exe

YourFileDownloader Installer

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application yourfiledownloader0kvvv8aqe9.exe by Via Advertising Group Limited has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. It is also typically executed from the user's temporary directory.

File name:

Publisher:

http://yourfiledownloader.net (signed by Via Advertising Group Limited)

Product:

YourFileDownloader Installer

Version:

1, 0, 269, 1

MD5:

2fb26c8ddb3b5b3d7aa3ddf5ded7bbab

SHA-1:

6804b2406630538255169d84a9a7c9bf4fbf8ba5

SHA-256:

b3dd722bfb5254a6b92a0906d70122bf4cf21dca3d3c48551b2bd5c2222aa2db

Scanner detections:

25 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/19/2024 10:08:27 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Kazy.567021

6373653

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

Win-PUP/YourFileDownloader

2015.03.27

Avira AntiVirus

APPL/Downloader.Gen8

7.11.171.232

avast!

Win32:Downloader-UEO [PUP]

2014.9-150327

AVG

Adware BundleApp_r

2016.0.3158

Bitdefender

Gen:Variant.Kazy.567021

1.0.20.430

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

Virus.Win32.Virut.CE

19699

Dr.Web

Adware.Downware.8424

9.0.1.086

Emsisoft Anti-Malware

Gen:Variant.Kazy.567021

9.0.0.4799

ESET NOD32

Win32/ExpressDownloader.J potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

Riskware/ExpressDownloader

3/27/2015

F-Prot

W32/A-42de288b

v6.4.7.1.166

F-Secure

Gen:Variant.Kazy.567021

5.13.68

G Data

Gen:Variant.Kazy.567021

15.3.25

herdProtect (fuzzy)

variant of lost_girl_s03.5_webisodes_upyurs6,_red_tape,_etc._downloader.exe (Adware)

2015.7.2.0

K7 AntiVirus

Adware

13.183.13358

Malwarebytes

PUP.Optional.Downloader

v2015.03.27.06

MicroWorld eScan

Gen:Variant.Kazy.567021

16.0.0.258

Reason Heuristics

PUP.Bundler.Via Advertising

15.3.27.6

Sophos

Go For Files

4.98

Vba32 AntiVirus

Downloader.AdLoad

3.12.26.3

VIPRE Antivirus

Threat.4758264

33624

Zillya! Antivirus

Downloader.Adload.Win32.17774

2.0.0.2118

File size:

3.3 MB (3,508,184 bytes)

Product version:

1.0.0.1

Original file name:

YourFileDownloaderInstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

YourFile Downloader

Language:

English

Common path:

C:\users\{user}\appdata\local\temp\yourfiledownloader0kvvv8aqe9.exe

Digital Signature

Signed by:

Via Advertising Group Limited

Authority:

COMODO CA Limited

Valid from:

4/12/2013 2:00:00 AM

Valid to:

4/12/2016 1:59:59 AM

Subject:

CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00BABC309174F531C6762BBA466401FEAF

File PE Metadata

Compilation timestamp:

10/2/2014 4:14:32 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

98304:QFXSEXPJ08C7tjnQ5F1FgRrW0aQp1c1vFR:SXR08C7tjdxF1pSJ

Entry address:

0x68332D

Entry point:

60, 68, 8A, 59, DD, F8, 60, 50, C7, 44, 24, 44, 01, 81, 2A, DD, E8, B7, 75, 00, 00, CE, 88, E3, 1B, 1D, 8F, 72, 33, FD, 17, 7B, 55, 01, 3A, B3, 4D, 59, 53, DB, 94, 19, 74, A7, C1, B9, D2, 6F, E9, 19, F2, 53, CC, 1D, B6, 05, 1F, 4A, 58, 0D, 03, 5C, E7, B1, 0B, DB, 54, 54, 36, E6, AA, A0, 5C, 03, 42, C4, 74, 0C, 9E, 50, 8A, E6, 86, 74, BA, 14, 17, 76, BE, 9C, EB, B5, A1, 1A, 1A, 22, 3A, 9A, 5F, 33, 69, F2, 8B, E9, B3, 0D, D4, D6, 50, 53, 8B, 6B, A5, 21, EB, 45, B4, 7E, D8, A8, A1, 84, FE, 45, DE, 22, 9B, 0F... 
[+]

Code size:

766.5 KB (784,896 bytes)

Remove yourfiledownloader0kvvv8aqe9.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.