home

bundle.exe

Amonetize ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application bundle.exe by Amonetize ltd has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Amonetize ltd.  (signed and verified)

MD5:
48592ea4f119d2df23a61d6c0353f96d

SHA-1:
2a30fa0ac9a8c1d71bd9784de4d1641e7341a326

SHA-256:
a3bd26bb261589010307777b93d9bf09de2ad151bf4c3350a527a3f78ce4d492

Scanner detections:
13 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/22/2025 7:24:15 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetize
14.03.22

avast!
Win32:Amonetize-Q [PUP]
2014.9-140322

AVG
MalSign.Generic
2015.0.3528

Dr.Web
Adware.Downware.1659
9.0.1.081

ESET NOD32
Win32/Amonetize (variant)
8.9559

K7 AntiVirus
Unwanted-Program
13.176.11482

Malwarebytes
PUP.Optional.Amonetize.A
v2014.03.22.10

McAfee
Artemis!48592EA4F119
5600.7184

Reason Heuristics
PUP.Amonetizeltd.G
14.8.7.20

Sophos
Amonetize
4.98

Trend Micro House Call
TROJ_GEN.F47V1104
7.2.81

VIPRE Antivirus
Amonetize
27520

File size:
70 KB (71,720 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\addons\bundle.exe

Digital Signature
Signed by:
Amonetize ltd.

Authority:
Thawte, Inc.

Valid from:
3/19/2013 9:00:00 AM

Valid to:
6/19/2015 8:59:59 AM

Subject:
CN=Amonetize ltd., O=Amonetize ltd., L=Raanana, S=Alberta, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
235E7B2F1D4E0152189F6381E2BA8C97

File PE Metadata
Compilation timestamp:
10/16/2013 5:39:12 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:9mNCYqR4Z2saGygFYPcWukr53rlByj2iO:0Na4Z2saGhFYcbkr5ij2

Entry address:
0x292A0

Entry point:
60, BE, 00, A0, 41, 00, 8D, BE, 00, 70, FE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Entropy:
7.8552

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
64 KB (65,536 bytes)

The file bundle.exe has been seen being distributed by the following URL.

http://i1.stylezip.info/.../Bundle2.exe

Remove bundle.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.