» 2_hanuman_j.._downloader.exe
Overview
Analysis
File Details
Downloads (1)

2_hanuman_j.._downloader.exe

YourFileDownloader Installer

Gtone LLC

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application 2_hanuman_j.._downloader.exe by Gtone has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dj234.yourfiledl.com.

File name:

Publisher:

http://yourfile-downloader.com (signed by Gtone LLC)

Product:

YourFileDownloader Installer

Version:

1, 0, 709, 1

MD5:

f90d52d4702a0eadc839e17e20745206

SHA-1:

784aabdd7c438175d5057d66f41563915036e10a

SHA-256:

ff9859b1155ff7645fced69f3164dd319b8264ac6d53d4878f90a5ef77a82ba0

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/14/2024 9:09:47 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Via Advertising.Gtone.Bundler (M)

16.6.16.5

File size:

6.3 MB (6,579,568 bytes)

Product version:

1.0.0.1

Original file name:

YourFileDownloaderInstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

YourFile Downloader

Language:

English

Common path:

C:\users\{user}\downloads\2_hanuman_j.._downloader.exe

Digital Signature

Signed by:

Gtone LLC

Authority:

Gtone LLC

Valid from:

5/14/2015 11:50:31 PM

Valid to:

5/13/2016 11:50:31 PM

Subject:

CN=Gtone LLC, O=Gtone LLC, S=London, C=UK

Issuer:

CN=Gtone LLC, C=UK, S=London, L=London, E=admin@gtone.com, O=Gtone LLC

Serial number:

100001

File PE Metadata

Compilation timestamp:

5/21/2015 1:15:05 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

98304:IaNcplaXTNcP6LC/loXYaYvPHBZ1F52E8gzSHNmbAki7qefarG+/D:IaGaOP6LC/loXYa+HTTQxzt/ki7qefat

Entry address:

0x6C09E2

Entry point:

E9, A6, FE, 01, 00, 79, A9, 50, F5, D1, 54, 49, FA, AE, 5E, 43, 8F, 5C, B8, AC, EC, 5A, 46, 8E, 1E, 4E, 5E, F9, F9, 00, D0, 32, AE, 8A, 7A, 62, 12, 2A, DA, FE, 3E, D9, 57, 89, 9F, 8B, 5B, 4B, 0B, E2, 82, 52, 72, 25, 7B, 05, B5, D5, 6A, CA, 05, 86, 01, 80, B0, C8, 08, 46, 23, 32, 2B, AB, 33, 88, 84, D8, B9, AE, 10, 9F, 8B, 5E, 8E, CD, 18, 6D, 60, 4F, 63, 39, 4E, 93, 9A, 6A, A5, 5B, 1B, 42, 4A, EE, 2D, 6D, FC, 38, F8, A5, 57, 43, 0E, 4A, 0A, 5A, 0E, 6E, 85, E1, EE, 2F, D4, 88, 3A, 92, FF, BB, 68, CA, 4F, 29... 
[+]

Entropy:

7.9589

Packer / compiler:

Xtreme-Protector v1.05

Code size:

1.1 MB (1,188,864 bytes)

The file 2_hanuman_j.._downloader.exe has been seen being distributed by the following URL.

http://dj234.yourfiledl.com/j5H3HGrRp05r1aMUYJb/ZXrP6HYm8 t5J/zteyzukiZ8pYFqE DZbxLs3HlauYMXQLmHOFuExFgQkI8OXI5oEGGYfAcnzTFdJZhkHCHFI6U6mGbYOm9q/2tleaI0bVW9N2JD ERkTeg5d0LqBGxD2lNVe4EARVjHKUdRxhlDHt0REXSR9lQ65O9EcI67D3/xvgl7/6Vubu3jJQKn zsJ7qoqVeGVNVnrn2IP6c9rSYWaaxSD1wVP0o9UTYuJUbKVmBnkyoE4r5ehSeiR7Bvwd/NRpCGh9ftistv bq61kzWu/spzl/PdRI/wkC3M6tBNiqGHFcOSn1/L0IsJkc24DsvI/.../b4nE73bZ dvW8e3f3uX54 9M3

Remove 2_hanuman_j.._downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.