home

18 only girls valeri_10924_i42469494_il345.exe

Runner Utility

BERSHNET LLC

The application 18 only girls valeri_10924_i42469494_il345.exe by BERSHNET has been detected as adware by 30 anti-malware scanners. This is a setup program which is used to install the application. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from files.red-1-small-button.com.
Publisher:
Dummy, Ltd.  (signed by BERSHNET LLC)

Product:
Runner Utility

Version:
1.0.0.187

MD5:
0c39662f8585625536fbd3e2b66469da

SHA-1:
c80cef52a3f37270b4729bedf78aece3c26e9ff9

SHA-256:
32710932c626ed00819fb919e4ee0de6d79f561fb27dab37edd930716f605297

Scanner detections:
30 / 68

Status:
Adware

Analysis date:
11/28/2024 2:37:39 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.597337
5648785

Agnitum Outpost
PUA.Downloader
7.1.1

AhnLab V3 Security
PUP/Win32.LoadMoney
2015.04.19

Avira AntiVirus
ADWARE/Adware.Gen7
3.6.1.96

AVG
Generic
2016.0.3135

Baidu Antivirus
PUA.Win32.Dlhelper
4.0.3.15418

Bitdefender
Gen:Variant.Kazy.597337
1.0.20.540

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.LoadMoney.IARS
21816

Dr.Web
Trojan.Amonetize
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Kazy.597337
9.0.0.4799

ESET NOD32
Win32/Amonetize.DW potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Agent
4/18/2015

F-Prot
W32/S-53544127
v6.4.7.1.166

F-Secure
Gen:Variant.Kazy.597337
5.13.68

G Data
Gen:Variant.Kazy.597337
15.4.25

K7 AntiVirus
Unwanted-Program
13.202.15640

Kaspersky
not-a-virus:Downloader.Win32.Agent
15.0.0.543

Malwarebytes
PUP.Optional.Amonetize
v2015.04.18.11

McAfee
Program.Artemis!0C39662F8585
16.8.708.2

MicroWorld eScan
Gen:Variant.Kazy.597337
16.0.0.324

NANO AntiVirus
Trojan.Win32.Agent.dpuomx
0.30.16.1110

Panda Antivirus
Trj/Genetic.gen
15.04.18.11

Qihoo 360 Security
HEUR/QVM16.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.BERSHNET
15.4.18.23

Sophos
Generic PUA MI
4.98

Trend Micro House Call
TROJ_GEN.R021C0ECF15
7.2.108

Trend Micro
TROJ_GEN.R021C0ECF15
10.465.18

VIPRE Antivirus
Threat.4785227
38882

Zillya! Antivirus
Downloader.Agent.Win32.247041
2.0.0.2143

File size:
1.5 MB (1,568,784 bytes)

Product version:
1.0.0.187

Copyright:
Copyright (C) 2013

Original file name:
runner.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\18 only girls valeri_10924_i42469494_il345.exe

Digital Signature
Signed by:
BERSHNET LLC

Authority:
COMODO CA Limited

Valid from:
2/5/2015 4:00:00 PM

Valid to:
2/6/2016 3:59:59 PM

Subject:
CN=BERSHNET LLC, O=BERSHNET LLC, STREET="st. 600-richya b.66, of.10", L=Vinnitsya, S=Vinnitskaya, PostalCode=21027, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E2D6C6F8DDF832E09DCF766B299AD2A9

File PE Metadata
Compilation timestamp:
3/9/2015 3:43:06 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:8GgdlhsnvN9WFwsq9UiM7rTIH4ZzIurNhySwjnDaFfi3Xhsd6PbEonWyk1Q1r2ya:8Ggd8vjWFF/7/jZ8uvydnDa6hsd6Pbba

Entry address:
0x3E9FB0

Entry point:
60, 66, C7, 04, 24, 45, 84, 60, C7, 44, 24, 3C, 3F, 9B, 0C, CF, 51, C6, 44, 24, 08, A7, 54, C6, 44, 24, 08, 97, C7, 44, 24, 40, 11, 50, B4, 82, 9C, FF, 74, 24, 04, 8D, 64, 24, 48, E9, D4, E2, 00, 00, F9, 89, 7D, E4, 0F, BA, E2, 05, 66, 01, C7, E8, AB, 65, 00, 00, E9, 09, 2B, 00, 00, 84, C5, 60, 53, FF, 37, 8F, 44, 24, 24, 9C, 9C, 39, DF, 88, 6C, 24, 08, 88, 3C, 24, 88, 6C, 24, 10, 8D, 64, 24, 2C, 0F, 87, 6A, 7E, FF, FF, D2, F0, F8, E8, DD, 95, F1, FF, 66, C7, 44, 24, 04, 90, CC, 9C, 8D, 64, 24, 28, 0F, 84...
 
[+]

Entropy:
7.9950  (probably packed)

Code size:
187.5 KB (192,000 bytes)

The file 18 only girls valeri_10924_i42469494_il345.exe has been seen being distributed by the following URL.

http://files.red-1-small-button.com/p/.../18 only girls valeri_10924_i42469494_il345.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.