ytdsetup.exe

YTD Video Downloader

GreenTree Applications srl

The application ytdsetup.exe, “YTD Video Downloader stub installer” by GreenTree Applications srl has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dj52lmmh49bpt.cloudfront.net and multiple other hosts. While running, it connects to the Internet address hosted-by.leaseweb.com on port 80 using the HTTP protocol.
Publisher:
GreenTree Applications srl  (signed and verified)

Product:
YTD Video Downloader

Description:
YTD Video Downloader stub installer

Version:
4.8.9.7

MD5:
da95ffac0c692eaefa98db336b834f8d

SHA-1:
21edf2e4cd749abbcd91f53a94e3dddf3b808dc1

SHA-256:
c562fdab4bcaf971e43cb28c3f232d9dfb6b3ecd196730f0b2f6cc157294cee9

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
This is part of a Greentree bundled installer, which includes various adware, toolbars and co-bundled potentially unwanted apps pushed to the user upon setup.

Analysis date:
4/25/2024 5:17:57 AM UTC  (today)

Scan engine
Detection
Engine version

McAfee
Artemis!DA95FFAC0C69
5600.6841

Reason Heuristics
PUP.Optional.Installer
15.2.27.13

Trend Micro House Call
Suspicious_GEN.F47V0218
7.2.58

File size:
101.5 KB (103,896 bytes)

Product version:
4.8.9.7

Copyright:
(c) 2014 GreenTree Applications SRL. All rights reserved.

Original file name:
YTDStub.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\ytdsetup.exe

Digital Signature
Authority:
Starfield Technologies, Inc.

Valid from:
2/17/2015 9:55:38 AM

Valid to:
11/18/2015 10:32:14 AM

Subject:
CN=GreenTree Applications srl, O=GreenTree Applications srl, L=Bucuresti, C=RO

Issuer:
CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00C427DA8891A2EF29

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:9QpQ5EP0ijnRTXJH68gkW+RoeGd8yNkM/Dk2296C/CGzYCUcxFbD+GH:9QIURTXJH7Ozd8yNkaG6CxzYCUv4

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.1799

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file ytdsetup.exe has been seen being distributed by the following 50 URLs.

http://dj52lmmh49bpt.cloudfront.net/buWe1pNXBcrd1D8NfJ8AOnjHRilVg2gT8nBsPsw0Mms

http://d257b6u96q0rx9.cloudfront.net/X60i2J7HnWw2NW4956Ifg82J0-7fU_FZ13F9oi_qqgM

http://d3pl27v98cqq7i.cloudfront.net/oby5EHZVOEGtxOsVNYU9kNMoq1COhm6zj3o5rD-SztQ

Latest 30 of 60 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (5.79.67.111:80)

Remove ytdsetup.exe - Powered by Reason Core Security