home

download bully scholarship edition pc games download__6330_il832912.exe

Installer

The application download bully scholarship edition pc games download__6330_il832912.exe has been detected as a potentially unwanted program by 10 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.specificdownload.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Product:
Installer

Version:
1.1.6.20

MD5:
8ea736c4d11bc3be728fb50383662dd2

SHA-1:
fe6c0145e563088a48a233a375ec9e0f5d1917b8

SHA-256:
8320b726b3f47068ddf99a59c0cb7c9caf6bf6912dad30268453f004a32604b0

Scanner detections:
10 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 3:50:20 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.02.21

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.132.242

avast!
Win32:Amonetize-F [PUP]
2014.9-140425

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.14425

Dr.Web
Adware.Downware.2160
9.0.1.0115

ESET NOD32
Win32/Amonetize.AG (variant)
8.9449

G Data
Win32.Application.Amonetize
14.4.24

Malwarebytes
PUP.Optional.Amonetize
v2014.04.25.11

Reason Heuristics
Threat.Win.Reputation.IMP
14.4.25.23

Trend Micro House Call
TROJ_GEN.F47V0219
7.2.115

File size:
323.5 KB (331,264 bytes)

Product version:
2.1.12

Copyright:
Copyright(c), All Rights Reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\download bully scholarship edition pc games download__6330_il832912.exe

File PE Metadata
Compilation timestamp:
2/19/2014 5:07:07 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:BU+8puNQb5e0UAqqcWJ8jBfuKH92weycDZ0xrxxeUZD+DjUIYVN+Zkg/XSWpCFu:BUDpuNCo0UAFcWJ8tfuo9xRD2jUIMN+9

Entry address:
0x27234

Entry point:
E8, BC, 95, 00, 00, E9, 89, FE, FF, FF, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00, 00, 00, 8B, D1, 83, E1, 7F, C1, EA, 07, 74, 65, EB, 06, 8D, 9B, 00, 00, 00, 00, 66, 0F, 6F, 06, 66, 0F, 6F, 4E, 10, 66, 0F, 6F, 56, 20, 66, 0F, 6F, 5E, 30, 66, 0F, 7F, 07, 66, 0F, 7F, 4F, 10, 66, 0F, 7F, 57, 20, 66, 0F, 7F, 5F, 30, 66, 0F, 6F, 66, 40, 66, 0F, 6F, 6E, 50, 66, 0F, 6F, 76, 60, 66, 0F, 6F, 7E, 70, 66, 0F, 7F, 67, 40, 66, 0F, 7F, 6F, 50, 66, 0F, 7F, 77, 60, 66, 0F, 7F, 7F, 70, 8D, B6, 80, 00, 00, 00, 8D, BF...
 
[+]

Code size:
229.5 KB (235,008 bytes)

The file download bully scholarship edition pc games download__6330_il832912.exe has been seen being distributed by the following 2 URLs.

http://www.specificdownload.com/download.php?version=1.1.6.20&prefix=SmadAV Pro Rev. 9.6.1 Update 2014 Terbaru&campid=6167&instid[appname]=SmadAV Pro Rev. 9.6.1 Update 2014 Terbaru&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.specificdownload.com/download.php?version=1.1.6.20&prefix=Download Bully Scholarship Edition Pc Games Download&campid=6330&instid[appname]=Download Bully Scholarship Edition Pc Games Download&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.