» cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe
Overview
Analysis
File Details
Downloads (13)
Network (2)

cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe

Installer

The application cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe has been detected as a potentially unwanted program by 11 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from download-instantly.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.

File name:

Product:

Installer

Version:

1.1.5.90

MD5:

bb642371cfd80a425aab4a9845d24a71

SHA-1:

d03046ab28c1c854ae0b173bac72891368ed2048

SHA-256:

56a63a0f15e94c4e88d6e7d6dba6b1dafe6f9c33dbb3f47999f286ce888c2a84

Scanner detections:

11 / 68

Status:

Potentially unwanted

Analysis date:

11/2/2024 11:25:21 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.02.08

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.130.36

avast!

Win32:Amonetize-E [PUP]

2014.9-140208

AVG

Generic_r

2015.0.3570

Baidu Antivirus

Trojan.Win32.Amonetize

4.0.3.1428

ESET NOD32

Win32/Amonetize.AE (variant)

8.9397

Malwarebytes

PUP.Optional.Amonetize

v2014.02.08.06

McAfee

Artemis!BB642371CFD8

5600.7226

Trend Micro House Call

TROJ_GEN.F47V0206

7.2.39

VIPRE Antivirus

Trojan.Win32.Generic

26258

XVirus List

Win.Detected

2.3.31

File size:

326 KB (333,824 bytes)

Product version:

2.1.12

Original file name:

Installer.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe

File PE Metadata

Compilation timestamp:

2/6/2014 4:41:13 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:19DGT4tc6WpCIe2b8aAt74pHBpxPoRz0eCQdCLIfEb0Mwqf0WwmEA4cDps:19aT4ttW8Ie2oaAt74phpxjsMIfZMTBh

Entry address:

0x275D4

Entry point:

E8, 9A, 95, 00, 00, E9, 89, FE, FF, FF, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00, 00, 00, 8B, D1, 83, E1, 7F, C1, EA, 07, 74, 65, EB, 06, 8D, 9B, 00, 00, 00, 00, 66, 0F, 6F, 06, 66, 0F, 6F, 4E, 10, 66, 0F, 6F, 56, 20, 66, 0F, 6F, 5E, 30, 66, 0F, 7F, 07, 66, 0F, 7F, 4F, 10, 66, 0F, 7F, 57, 20, 66, 0F, 7F, 5F, 30, 66, 0F, 6F, 66, 40, 66, 0F, 6F, 6E, 50, 66, 0F, 6F, 76, 60, 66, 0F, 6F, 7E, 70, 66, 0F, 7F, 67, 40, 66, 0F, 7F, 6F, 50, 66, 0F, 7F, 77, 60, 66, 0F, 7F, 7F, 70, 8D, B6, 80, 00, 00, 00, 8D, BF... 
[+]

Code size:

231.5 KB (237,056 bytes)

The file cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe has been seen being distributed by the following 13 URLs.

http://download-instantly.com/isn/js/https://secure.driversupport.com/direct/.../driversupport.exe

http://download-instantly.com/isn/js/http://download.uniblue.com/cm/pcproblem/speedupmypc/banner1/.../speedupmypc.exe

http://www.downloadfastnow.com/download.php?version=1.1.5.90&campid=2681&instid[appname]=CounterStrike16&instid[appsetupurl]=http://.../download3.exe

http://www.v4download.com/download.php?title=CounterStrike1.6&id=marketone

http://www.goo.gl/SeMv7o

http://justdownloadnow.info/download.php?version=1.1.5.90&campid=2681&instid[appname]=CyberGhost VPN License &instid[appsetupurl]=http://www.idlprovider.com/.../download3.exe

http://v4download.com/.../download.php?id=mariusik93&title=CyberGhost VPN License &url=www.hackzgame.com

http://www.v4download.com/download.php?id=smithtown&title=Top-Eleven-Hack

http://q=http://.../1gsVOjC

http://download-fast.net/b/download.php?id=k3nshy&title=Tom Clancys Ghost Recon Future Soldier 1.8 Update&url=http://idlprovider.com/.../download.php?id=k3nshy

http://q=http://.../1btNPP4

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.softologic.com (174.37.181.31:80)

TCP (HTTP SSL):

Connects to www.ibbalance.com (173.192.190.227:443)

Remove cityville hack gold cash level xp energy__2681_i336505601_il2062201.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.