home

driver tuner__4869_il44717.exe

Installer

The application driver tuner__4869_il44717.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.formerdownload.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Product:
Installer

Version:
1.1.6.20

MD5:
7c5d4945551708b05d5db6448e4eaae7

SHA-1:
5d0980c46189275af4f55f48b5aac4ec7dd3fef0

SHA-256:
581f14092fdbfb2cad634f6173642ea4c053978ef3bfba426257406cf1f122cc

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 3:14:57 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.02.07

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.129.216

Baidu Antivirus
Trojan.Win32.Amonetize
4.0.3.1426

Dr.Web
Adware.Downware.1833
9.0.1.037

ESET NOD32
Win32/Amonetize.AD (variant)
8.9389

Malwarebytes
PUP.Optional.Amonetize
v2014.02.06.08

File size:
325.5 KB (333,312 bytes)

Product version:
2.1.12

Copyright:
(c) 2012,2013. All rights reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\driver tuner__4869_il44717.exe

File PE Metadata
Compilation timestamp:
2/6/2014 7:54:06 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:7wEdS+sC303baiII5Vk7tBSbEQF7Yezf0Life+qcEb03RV02HQ9LjpOo0:7wEk+sCE3baEVk7XSbsv9cZ3ThHQppO

Entry address:
0x27394

Entry point:
E8, 9D, 95, 00, 00, E9, 89, FE, FF, FF, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00, 00, 00, 8B, D1, 83, E1, 7F, C1, EA, 07, 74, 65, EB, 06, 8D, 9B, 00, 00, 00, 00, 66, 0F, 6F, 06, 66, 0F, 6F, 4E, 10, 66, 0F, 6F, 56, 20, 66, 0F, 6F, 5E, 30, 66, 0F, 7F, 07, 66, 0F, 7F, 4F, 10, 66, 0F, 7F, 57, 20, 66, 0F, 7F, 5F, 30, 66, 0F, 6F, 66, 40, 66, 0F, 6F, 6E, 50, 66, 0F, 6F, 76, 60, 66, 0F, 6F, 7E, 70, 66, 0F, 7F, 67, 40, 66, 0F, 7F, 6F, 50, 66, 0F, 7F, 77, 60, 66, 0F, 7F, 7F, 70, 8D, B6, 80, 00, 00, 00, 8D, BF...
 
[+]

Entropy:
6.4216

Code size:
231 KB (236,544 bytes)

The file driver tuner__4869_il44717.exe has been seen being distributed by the following 6 URLs.

http://www.formerdownload.com/download.php?version=1.1.6.20&prefix=Grand Theft Auto GTA 4 PC Game Full Version Free Download&campid=5385&instid[appname]=Grand Theft Auto GTA 4 PC Game Full Version Free Download&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=NzI0fDE3MzR8RUN8M3wxfHw|f1083ef8b33baf993d96198897c89bb7

http://www.formerdownload.com/download.php?version=1.1.6.20&prefix=Jurassic Park Operation Genesis [Full version]&campid=5207&instid[appname]=Jurassic Park Operation Genesis [Full version]&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4411&capp=s7zip&prefix=GameSetup

http://www.formerdownload.com/download.php?version=1.1.6.20&prefix=At All&campid=4409&instid[appname]=At All&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.formerdownload.com/download.php?version=1.1.6.20&prefix=Download Starting...&campid=4490&instid[appname]=Download Starting...&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove driver tuner__4869_il44717.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.