home

youtube-dlm_1.0_en-us.exe

DownloadGuide

Digitainment AG

The application youtube-dlm_1.0_en-us.exe by Digitainment AG has been detected as adware by 13 anti-malware scanners. The file has been seen being downloaded from downloadguidefactory.blob.core.windows.net.
Publisher:
Digitainment AG  (signed and verified)

Product:
DownloadGuide

Version:
2.5.0.107

MD5:
d19906931cd0c8abdfcdd8609713a702

SHA-1:
7f4827002cec57d1af0b47632c15ba580a22297c

SHA-256:
80e14cd901cfca90ef127ea8e1bdb9fc6b88e47dde842ef5acde737e66d98593

Scanner detections:
13 / 68

Status:
Adware

Analysis date:
4/19/2024 10:59:36 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Downloader
2015.03.06

Avira AntiVirus
TR/Dropper.Gen
7.11.214.2

AVG
Generic
2016.0.3179

Dr.Web
Trojan.DownLoader9.15219
9.0.1.064

ESET NOD32
MSIL/DownloadGuide
9.9382

F-Secure
Adware:W32/Buzzrin
5.13.68

herdProtect (fuzzy)
variant of DownloadGuide.exe (PUP)
2015.6.12.3

K7 AntiVirus
Trojan
13.200.15173

McAfee
Artemis!38019EB2673D
5600.6737

Reason Heuristics
PUP.DigitainmentAG
15.3.5.12

Trend Micro House Call
TROJ_GEN.F47V0130
7.2.163

VIPRE Antivirus
Threat.4150696
37788

File size:
652.6 KB (668,232 bytes)

Product version:
2.5.0.107

Copyright:
Copyright © 2013

Original file name:
DownloadGuide.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\youtube-dlm_1.0_en-us.exe

Digital Signature
Signed by:
Digitainment AG

Authority:
COMODO CA Limited

Valid from:
12/8/2013 6:00:00 PM

Valid to:
12/9/2015 5:59:59 PM

Subject:
CN=Digitainment AG, O=Digitainment AG, STREET=Schulstrasse 7, L=Würenlingen, S=Aargau, PostalCode=5303, C=CH

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
646A1470B7987C344845192F6B828D61

File PE Metadata
Compilation timestamp:
11/12/2013 10:28:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:PzE3Y3SrCba1p6ZXWeTRA66isIu9LuFX1Yu:QBrCb0pXPJI2yFFYu

Entry address:
0x8A02E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7149

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
544.5 KB (557,568 bytes)

The file youtube-dlm_1.0_en-us.exe has been seen being distributed by the following URL.

https://downloadguidefactory.blob.core.windows.net/downloadguides/.../youtube-dlm_1.0_en-US.exe

Remove youtube-dlm_1.0_en-us.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.