» brian_lara_cricket_99_for_xp_downloader.exe
Overview
Analysis
File Details
Downloads (2)

brian_lara_cricket_99_for_xp_downloader.exe

YourFileDownloader Installer

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application brian_lara_cricket_99_for_xp_downloader.exe by Via Advertising Group Limited has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dll513.yourfdownloader.net and multiple other hosts.

File name:

Publisher:

http://yourfile-downloader.com (signed by Via Advertising Group Limited)

Product:

YourFileDownloader Installer

Version:

1, 0, 509, 1

MD5:

e471086e24ab02ee4920cefe7d0a2654

SHA-1:

499b0203b22bb526c8882ffcc2b3f12eeb42e4c4

SHA-256:

b8f11d4b5a746f333e2e0714dceab8900197b304cc11fde7279cf5e0a4bc3a12

Scanner detections:

11 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/14/2024 9:37:02 PM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

Win-PUP/YourFileDownloader

2015.02.02

Avira AntiVirus

APPL/Downloader.Gen4

7.11.206.100

avast!

Win32:Downloader-UEO [PUP]

150129-1

AVG

Generic

2016.0.3211

Comodo Security

Virus.Win32.Virut.CE

20927

Dr.Web

Adware.Downware.9685

9.0.1.05190

ESET NOD32

Win32/ExpressDownloader.K potentially unwanted application

7.0.302.0

K7 AntiVirus

Unwanted-Program

13.193.14824

Reason Heuristics

PUP.Installer.Via Advertising

15.2.1.16

Sophos

PUA 'Go For Files'

5.10

VIPRE Antivirus

Threat.4758264

36694

File size:

4 MB (4,240,864 bytes)

Product version:

1.0.0.1

Original file name:

YourFileDownloaderInstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

YourFile Downloader

Language:

English (United States)

Common path:

C:\Documents and Settings\{user}\My documents\downloads\brian_lara_cricket_99_for_xp_downloader.exe

Digital Signature

Signed by:

Via Advertising Group Limited

Authority:

COMODO CA Limited

Valid from:

4/12/2013 1:00:00 AM

Valid to:

4/12/2016 12:59:59 AM

Subject:

CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00BABC309174F531C6762BBA466401FEAF

File PE Metadata

Compilation timestamp:

1/23/2015 10:55:09 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

49152:qjuYJoT0BwCG2stpD0skLI+XCKUsiDviV8f4J0hbECcv5lKo/I98hO212XK+XsDu:1YJoNCgWJyKUsgF4JQRA/SE32VXZF0zC

Entry address:

0x4A15EE

Entry point:

9C, E9, 08, 2F, FA, FF, F8, 30, D0, 01, FE, E8, 43, 2F, FA, FF, 8A, A3, 66, 64, 39, 1F, AB, 7D, 7F, B2, 5B, E1, A3, 92, 6F, D9, 22, 1D, B1, 91, 7C, CB, 2B, 0E, D2, 6E, 0A, 20, BA, 8B, 16, 1C, 8B, A7, 3D, 05, 38, ED, F7, 1F, 79, 8D, 3E, FF, D5, 68, 4E, EF, 15, 63, 51, 55, 01, 14, 25, C8, 84, E8, 99, A8, 60, E1, 73, 33, 45, 3F, 6C, 28, 04, F5, 0D, 2F, 11, 50, F2, FD, 45, 34, BA, 67, F8, 42, 76, 82, 65, 50, 7C, 72, 40, B9, 5C, C3, 52, DB, A5, 5E, 9A, 95, 53, F2, CF, 99, 6C, 28, B3, 0C, 85, 67, 21, C2, CC, F3... 
[+]

Entropy:

7.9151 (probably packed)

Code size:

786 KB (804,864 bytes)

The file brian_lara_cricket_99_for_xp_downloader.exe has been seen being distributed by the following 2 URLs.

http://dll513.yourfdownloader.net/j5GHRWvRp2RK1b9eVfujKm3XsDNN eAUUKuvEEK4xydt8dRjEOLRaRPs1G4Mq4QBR7jIVgLQzV8D0dsfW5p1HVueWh4mzTpdMoZsGSyRctw6hWXibzU/6DptfuRnPAfnOn96/w1jXaYSfEj DmtfxhoyVsgfBk3PBXtewA9GNcEHEQL1pEIs2uprLtPjWzqc4FNo/rQ0PbjJLS3yq39X/ax5VvmQaEfqlmNLqssHGYLdNEjSg1Id09BQHInbX KV3Q62kvZEvpn/Temd8xqjZfkYpiGn4aRInqLxaOftzzW97dEq1rbZaYnw2Hyex9hH066TVZPO3RbDlYwb3Nz8XtjHoE4/.../9dgL62ANhU=

http://dll513.yourfdownloader.net/j5GHRWvRp2RK1b9eVfujKm3XsDNN eAUUKuvEEK4xydt8dRjEOLRaRXi1WoMq4QBR7jIVgLQzVoD0NsfW5p1HVueWh4mzTpdMoZsGSyRctw6hWXibzU/6DptfuRnPAfnOn96/w1jXaYSfEj DmtfxhoyVsgfBk3PBXtewA9GNcEHEQL1pEIs2uprLtPjWzqc4FNo9LQ0PbjJLS3yq39X/ax5VvmQaEfqlmNLqssHGYLdNEjSg1Id09BQHInbX KV3Q62kvZEvpn/.../ oNqKfzVMUbm

Remove brian_lara_cricket_99_for_xp_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.