» age of empires__9367_il38491.exe
Overview
Analysis
File Details
Downloads (5)

age of empires__9367_il38491.exe

Wilmaonline LTD.

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application age of empires__9367_il38491.exe by Wilmaonline has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

Wilmaonline LTD. (signed and verified)

Version:

1.1.5.26

MD5:

0fcc057b4be5d565fce0c1354a2ec13b

SHA-1:

2db78c68cf69db13df5f8a5a85317cc6678e5e33

SHA-256:

7200d168f3dec6e1664e6c5d7eedff25f22b977f20300cc272aacafdbe19b128

Scanner detections:

17 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/26/2024 10:57:12 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.Amonetize.11

774

AhnLab V3 Security

PUP/Win32.Amonetize

2014.08.11

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.165.34

avast!

Win32:Amonetize-CU [PUP]

2014.9-141222

AVG

Generic

2015.0.3252

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.141222

Bitdefender

Gen:Variant.Application.Bundler.Amonetize.11

1.0.20.1780

ESET NOD32

Win32/Amonetize.BK (variant)

8.10200

Fortinet FortiGate

Adware/Amonetize

12/22/2014

F-Secure

Gen:Variant.Application.Bundler

11.2014-22-12_2

G Data

Win32.Application.Amonetize

14.8.24

Kaspersky

not-a-virus:AdWare.Win32.Amonetize

14.0.0.2757

Malwarebytes

PUP.Optional.Amonetize

v2014.08.04.06

MicroWorld eScan

Gen:Variant.Application.Bundler.Amonetize.11

15.0.0.1068

Reason Heuristics

PUP.Installer.Wilmaonline.CC

14.8.4.18

Sophos

Generic PUA NL

4.98

VIPRE Antivirus

Amonetize

32094

File size:

983.2 KB (1,006,784 bytes)

Product version:

1.1.5.26

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup

Language:

English (United States)

Common path:

C:\users\{user}\downloads\age of empires__9367_il38491.exe

Digital Signature

Signed by:

Wilmaonline LTD.

Authority:

Thawte, Inc.

Valid from:

7/7/2014 3:00:00 AM

Valid to:

8/7/2015 2:59:59 AM

Subject:

CN=Wilmaonline LTD., O=Wilmaonline LTD., L=Raanana, S=Israel, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

2B7DF4C242BFBB654DA05B78A86926AA

File PE Metadata

Compilation timestamp:

8/4/2014 12:03:25 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:WcLdx+5Y3l5UfyVLvsldrAeGVjIRsZu6GAQ7g9By3xjtPKJRgvJCrtJAEkVHC3na:V42jwjgjI8umRmMr5MVqJmf

Entry address:

0x66AF0

Entry point:

8B, FF, 55, 8B, EC, E8, C6, E6, 01, 00, E8, 11, 00, 00, 00, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 6A, FE, 68, 50, AD, 4D, 00, 68, F0, 90, 46, 00, 64, A1, 00, 00, 00, 00, 50, 83, C4, 98, 53, 56, 57, A1, 48, 54, 4E, 00, 31, 45, F8, 33, C5, 50, 8D, 45, F0, 64, A3, 00, 00, 00, 00, 89, 65, E8, C7, 45, 90, 00, 00, 00, 00, 8D, 45, A0, 50, FF, 15, A8, 51, 4B, 00, 83, 3D, 48, A9, 4E, 00, 00, 75, 0E, 6A, 00, 6A, 00, 6A, 01, 6A, 00, FF, 15, AC, 51, 4B, 00, E8, 8E, 01... 
[+]

Code size:

716.5 KB (733,696 bytes)

The file age of empires__9367_il38491.exe has been seen being distributed by the following 5 URLs.

http://www.generaldownload.com/download.php?version=1.1.5.26&campid=5160&instid[appsetupurl]=http://trichecode.com/wp-content/uploads/2014/05/hack.astucev2014.rar&instid[cmdline]=/S&instid[appimageurl]=http://.../2ew18b5.jpg&prefix=Setup&instid[appname]=Setup&instid[thankyoupage]=Google.com&ti1=1644816

http://evodownload.com/download.php?i=u6&name=Setup&v=1.02&url=http://trichecode.com/wp-content/uploads/2014/.../hack.astucev2014.rar&t=R29vZ2xlLmNvbQ==

http://www.widespreaddownload.com/download.php?version=1.1.5.26&campid=5160&instid[appsetupurl]=http://trichecode.com/wp-content/uploads/2014/05/hack.astucev2014.rar&instid[cmdline]=/S&instid[appimageurl]=http://.../2ew18b5.jpg&prefix=Setup&instid[appname]=Setup&instid[thankyoupage]=Google.com&ti1=2728947

http://www.generallydownload.com/download.php?version=1.1.5.26&campid=5542&instid[appname]=Dreamweaver CC crack-v103&instid[appsetupurl]=http://.../wp-content/v1001/Adobe Dreamweaver CC.exe&instid[cmdline]=/S&instid[appimageurl]=http://.../xforce-logo.jpg&prefix=DreamweaverCCcv103&instid[thankyoupage]=&ti1=dreamw

Remove age of empires__9367_il38491.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.