home

download flash disk lock. software pengunci flashdisk _ free download software _ flash disk lock do

Installer

The file download flash disk lock. software pengunci flashdisk _ free download software _ flash disk lock do has been detected as a potentially unwanted program by 10 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.conductdownload.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Product:
Installer

Version:
1.1.6.20

MD5:
d781c2d445ba41b6bdd996d26c2b637a

SHA-1:
fd2b0624b00403d6c6bc8e2c48f09402600190c4

SHA-256:
464efb6a2c23be22796c9e0f6f9695c9d6d78fe951ca56b49843eb5b8e0abbae

Scanner detections:
10 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 11:24:51 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.133.202

avast!
Win32:Amonetize-J [PUP]
2014.9-140226

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.14226

ESET NOD32
Win32/Amonetize.AG (variant)
8.9477

Fortinet FortiGate
Riskware/Amonetize
2/26/2014

G Data
Win32.Application.Amonetize
14.2.24

Malwarebytes
PUP.Optional.Amonetize.A
v2014.02.26.09

McAfee
Artemis!D781C2D445BA
5600.7207

Reason Heuristics
Threat.Win.Reputation.IMP
14.3.31.13

Trend Micro House Call
TROJ_GEN.F47V0226
7.2.57

File size:
323.5 KB (331,264 bytes)

Product version:
2.1.12

Copyright:
Copyright(c), All Rights Reserved.

Original file name:
Installer.exe

Language:
English (United States)

Common path:
C:\users\{user}\downloads\download flash disk lock. software pengunci flashdisk _ free download software _ flash disk lock download__4112_il1092550.exe

File PE Metadata
Compilation timestamp:
2/26/2014 3:53:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:oB2NKgnlmuxZw9ua6yj+B9c7W7Y22ez/QHOtc3UZjkwj5u67i26KNB/vXmZp6H:oBmKgnAYZw9l6yj+9clAcej9j5ucf6KE

Entry address:
0x27214

Entry point:
E8, BD, 95, 00, 00, E9, 89, FE, FF, FF, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00, 00, 00, 8B, D1, 83, E1, 7F, C1, EA, 07, 74, 65, EB, 06, 8D, 9B, 00, 00, 00, 00, 66, 0F, 6F, 06, 66, 0F, 6F, 4E, 10, 66, 0F, 6F, 56, 20, 66, 0F, 6F, 5E, 30, 66, 0F, 7F, 07, 66, 0F, 7F, 4F, 10, 66, 0F, 7F, 57, 20, 66, 0F, 7F, 5F, 30, 66, 0F, 6F, 66, 40, 66, 0F, 6F, 6E, 50, 66, 0F, 6F, 76, 60, 66, 0F, 6F, 7E, 70, 66, 0F, 7F, 67, 40, 66, 0F, 7F, 6F, 50, 66, 0F, 7F, 77, 60, 66, 0F, 7F, 7F, 70, 8D, B6, 80, 00, 00, 00, 8D, BF...
 
[+]

Code size:
229.5 KB (235,008 bytes)

The file download flash disk lock. software pengunci flashdisk _ free download software _ flash disk lock do has been seen being distributed by the following 10 URLs.

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=MTI0M3wxNzM0fEFFfDN8MXx8|f1083ef8b33baf993d96198897c89bb7

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6601&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=ADOBE CS5 32 BIT SUPPORT PACKAGE thethingy &instid[thankyoupage]=

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6578&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=FULL Insanity Workout Workout sheet &instid[thankyoupage]=

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=NzI0fDE2NzR8UEV8M3wxfHw|f1083ef8b33baf993d96198897c89bb7

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=NzI0fDE2NzR8RUN8M3wxfHw|f1083ef8b33baf993d96198897c89bb7

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6601&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=Riddick 2013 1080p Bluray HD Castellano &instid[thankyoupage]=

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6601&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=Minecraft Beta 1 7 3 Cracked portable Updatable Online &instid[thankyoupage]=

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6601&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=47 Ronin 2013 HDCAM NEW SOURCE XviD TODE&instid[thankyoupage]=

http://www.singulardownload.com/download.php?version=1.1.6.20&campid=6578&instid[appname]=http://downlite.net/download/DownLiteSilent2.exe&instid[cmdline]=&instid[appimageurl]=http://downlite.net/.../Logo_150.png&prefix=Paladin Press Magician s Arsenal Professional Tricks Of The &instid[thankyoupage]=

http://www.specificdownload.com/download.php?version=1.1.6.20&prefix=HitmanPro 3.7.9 Build 212 Serial key, crack, keygen&campid=3207&instid[appname]=HitmanPro 3.7.9 Build 212 Serial key, crack, keygen&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.