home

310714_am.exe

The application 310714_am.exe has been detected as a potentially unwanted program by 16 anti-malware scanners. This is a setup program which is used to install the application. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.2ndrequest.me.
MD5:
46474f658bcd0675b6902f4f7c68e8f2

SHA-1:
09bba81844f4ce871d55e74abde1f194d7292c6a

SHA-256:
5f4bd9bb0ec751f7aaafc880193f75b7070b3efee80a0f4b899b205b04d4efcf

Scanner detections:
16 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 2:23:19 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140908

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.1498

ESET NOD32
Win32/Amonetize.BH (variant)
8.10377

G Data
Win32.Trojan.Agent.0E9JMY
14.9.24

Kaspersky
not-a-virus:RiskTool.Win32.Agent
14.0.0.3280

McAfee
RDN/Generic.dx!df3
5600.7013

Panda Antivirus
Trj/Genetic.gen
14.09.08.10

Trend Micro House Call
Suspicious_GEN.F47V0905
7.2.251

File size:
149 KB (152,576 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\310714_am.exe

File PE Metadata
Compilation timestamp:
9/1/2014 11:57:36 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:k2yHO1KDfv8FpDTOOZ0+fYMNHfFNZXvYz4qj:kDi+fvKTOOZ0+fYM3NZvYzd

Entry address:
0xB332

Entry point:
E8, 18, 6E, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, E4, D2, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, EC, D0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, A8, 47, 42, 00, 89, 0D, A4, 47, 42, 00, 89, 15, A0, 47, 42, 00, 89, 1D, 9C, 47, 42, 00, 89, 35, 98, 47, 42, 00, 89, 3D...
 
[+]

Code size:
110.5 KB (113,152 bytes)

The file 310714_am.exe has been seen being distributed by the following URL.

http://www.2ndrequest.me/.../310714_am.exe

Remove 310714_am.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.