home

فلم_نيك_عربي_كامل_وطويل_و_واضح_(15_دقيقة)_-_jens18_net_-_downloader.exe

YourFileDownloader Installer

Supers INC

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application فلم_نيك_عربي_كامل_وطويل_و_واضح_(15_دقيقة)_-_jens18_net_-_downloader.exe by Supers INC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dll513.yourfdownloader.net.
Publisher:
http://yourfile-downloader.com  (signed by Supers INC)

Product:
YourFileDownloader Installer

Version:
1, 0, 509, 1

MD5:
38381b696460cb62f02b7e87666c46b6

SHA-1:
04fba459492a51bc82b259223c749c56d2e71981

SHA-256:
958c84f99098dfcf906d12326cd2e120192e34c602b589bce2bbc469c756372b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/29/2024 2:08:09 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Via Advertising.Supers.Bundler (M)
16.5.26.22

File size:
4 MB (4,185,864 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\فلم_نيك_عربي_كامل_وطويل_و_واضح_(15_دقيقة)_-_jens18_net_-_downloader.exe

Digital Signature
Signed by:
Supers INC

Authority:
Supers INC

Valid from:
2/9/2015 12:17:09 PM

Valid to:
2/9/2016 12:17:09 PM

Subject:
CN=supers.com, O=Supers INC, S=London, C=UK

Issuer:
CN=supers.com, C=UK, S=London, L=London, E=admin@supers.com, O=Supers INC

Serial number:
100002

File PE Metadata
Compilation timestamp:
1/24/2015 12:55:09 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:dkiQFGfbGx0/f/NkWtwVyKf5H047NZJT6vWh:dkRETh/nuWtwYY5HTNf6m

Entry address:
0x4B3A1A

Entry point:
68, D8, E4, 29, 83, 60, 60, C7, 44, 24, 40, DD, 22, 21, C0, 9C, C7, 44, 24, 40, 80, 11, 20, 7F, 89, 24, 24, 9C, 8D, 64, 24, 44, E9, 96, 7D, 32, 00, 9C, 60, 8D, 4C, 49, 0A, 9C, 9C, 9C, 9C, 8D, 64, 24, 50, E9, 61, DB, F9, FF, BB, BE, 96, EF, 70, 2A, 5A, 5C, B9, A9, EC, 4A, E6, F5, EA, 62, F4, AF, A6, EB, 70, 1B, 42, 4C, 10, 6F, F2, B7, 9C, 01, 56, 4D, 08, 9E, B6, DE, 7C, 2A, E0, AC, D5, 77, 59, 71, 75, A1, E0, 2A, 30, 09, 00, 2F, E6, 23, 58, D6, 2A, E6, 8C, F9, 63, E9, 50, 64, AC, 87, A1, C7, CF, F9, 65, 1A...
 
[+]

Entropy:
7.9139  (probably packed)

Code size:
786 KB (804,864 bytes)

The file فلم_نيك_عربي_كامل_وطويل_و_واضح_(15_دقيقة)_-_jens18_net_-_downloader.exe has been seen being distributed by the following URL.

http://dll513.yourfdownloader.net/j5HgczuV8Qoj8PQaMoz0BzeZ7XI55Z1yM/zral7xxGtf6aFuB jacAOQ1Xpo4dQnFvm3VhekwU533NgrA805MhXJQU5nyDpeAswoPn3dVbprxCCiFjk8s2IvOMtjLRmre0gdsiAnDN9fMRWnT1wIhlZdEONLBQGfXQF5ll8QeZhbaHySughs/74RDIivfGnmzApwg6plGI 9YW/3q31K9tp0QJbkdS3ig2xf u5hVNvveTHel1hLzvJcWK6DTbPKlUGuvace sr X OavlO8JboPqDbmsq0/4rWkOu2u0ma85cEq06CZLtailDma cNXgPnHeJvEhB3Q0M9OnM6oUKHYvEdnjfAdZdikXGGF4GV62KYYeq qPyuzuC12oY84f6iWeUG/hH1SsJ4ASbeEDVqujFp3p98ZU4WRMFmEaBBVs2sYf8AvDyKHUhY6xSWyYM0stnwyIaVkNSmpL2l z9/.../5MqGKtHqw157arMg==

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.