» YourFileDownloaderInstaller.exe
Overview
Analysis
File Details

YourFileDownloaderInstaller.exe

YourFileDownloader Installer

Mtech

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file YourFileDownloaderInstaller.exe by Mtech has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent.

File name:

Publisher:

http://yourfile-downloader.com (signed by Mtech)

Product:

YourFileDownloader Installer

Version:

1, 0, 665, 1

MD5:

12eacd759963039a44b3c15db886590e

SHA-1:

b11510b290a9b4af760fa73328b827b4384d1d15

SHA-256:

bdc88808df884ee028477652f4ffbd59d57621829dbaa03f2845d80dbe076508

Scanner detections:

14 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

5/11/2024 2:05:04 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.Agent.X

544

avast!

Win32:Adware-gen [Adw]

2014.9-150514

AVG

Adware BundleApp_r

2016.0.3022

Bkav FE

HW32.Packed

1.3.0.6379

Clam AntiVirus

Win.Adware.1239795

0.98/20486

Dr.Web

Adware.Downware.11105

9.0.1.0134

Emsisoft Anti-Malware

Application.Bundler.Agent.X

8.15.05.14.09

ESET NOD32

Win32/ExpressDownloader.E potentially unwanted application

9.7.0.302.0

F-Secure

Riskware.Application.Bundler.Agent

11.2015-14-05_5

herdProtect (fuzzy)

variant of kamasutra_malayalam_translation.exe (Adware)

2015.8.10.10

Malwarebytes

PUP.Optional.Downloader

v2015.05.14.09

MicroWorld eScan

Application.Bundler.Agent.X

16.0.0.666

Reason Heuristics

PUP.Via Advertising.Bundler

15.5.20.2

VIPRE Antivirus

Threat.4150696

39486

File size:

4.5 MB (4,704,088 bytes)

Product version:

1.0.0.1

Original file name:

YourFileDownloaderInstaller.exe

Bundler/Installer:

YourFile Downloader

Language:

English

Common path:

C:\users\{user}\appdata\local\temp\jtcvrnlgr3.tmp

Digital Signature

Signed by:

Mtech

Authority:

Mtech

Valid from:

4/23/2015 10:27:39 AM

Valid to:

4/22/2016 10:27:39 AM

Subject:

CN=Mtech, O=Mtech, S=London, C=UK

Issuer:

CN=Mtech, C=UK, S=London, L=London, E=admin@mtech.com, O=Mtech

Serial number:

100001

File PE Metadata

Compilation timestamp:

4/24/2015 6:32:16 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

98304:iweTWQRqN4Z4JxDirDJQPazcAm51aVa7GqkVjG4IQJfc21cm:jeT1Rjc5oQSYT51ao77kDIQJB1cm

Entry address:

0x8FC179

Entry point:

E8, 3D, D5, BE, FF, 9C, 60, 89, F4, 60, FF, 74, 24, 0C, FF, 74, 24, 08, 8D, 64, 24, 28, E9, CE, 1E, F6, FF, 77, 5D, 40, 8E, 2F, D6, E1, F6, C4, 28, B7, 15, BA, 5B, 94, 18, A7, 5E, 8E, 6E, 3A, D3, 08, D4, FE, E6, E0, E4, 98, 54, 76, 3E, 95, 27, 6A, 50, 13, 54, 3D, 50, 9C, E8, B6, 67, A1, 7C, 47, D6, 0B, 09, 10, FD, D4, B7, 3D, 1D, D7, C5, F3, 36, 89, 2C, 23, AF, 70, 4F, C2, 98, CB, C1, A3, EC, 25, B7, A4, 55, 5F, 1D, 48, 8E, 50, B8, 0D, 93, 9F, 55, 43, D2, 4E, E9, 6E, 8C, CC, 52, DC, 02, 94, 9A, 5A, 60, FF... 
[+]

Entropy:

7.9287 (probably packed)

Code size:

1.1 MB (1,163,776 bytes)

Remove YourFileDownloaderInstaller.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.