home

elements of photogrammetry wit downloader__3687_i1349582980_il685640.exe

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application elements of photogrammetry wit downloader__3687_i1349582980_il685640.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 34 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Shetef Solutions & Consulting (1998) Ltd.  (signed and verified)

Version:
1.1.5.26

MD5:
152adcc13643290c16d3179ecb9c0ae8

SHA-1:
8446d9e67f0619846fe806c1062c5dbef8b5a268

SHA-256:
a075556b1f5d5da7999480a592f5d4e4f04d815826538ad26a40f972ad0ed8b0

Scanner detections:
34 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/2/2024 7:14:36 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Amonetize.18
549

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2015.05.29

Avira AntiVirus
ADWARE/Adware.Gen4
8.3.1.6

avast!
Win32:Amonetize-HJ [PUP]
2014.9-150804

AVG
Generic_r
2016.0.3027

Baidu Antivirus
PUA.Win32.Amonetize
4.0.3.1584

Bitdefender
Gen:Variant.Application.Bundler.Amonetize.18
1.0.20.1080

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
22260

Dr.Web
Adware.Downware.8618
9.0.1.0216

ESET NOD32
Win32/Amonetize.BR potentially unwanted (variant)
9.11701

Fortinet FortiGate
Riskware/Amonetize
8/4/2015

F-Prot
W32/A-2cc77b1b
v6.4.7.1.166

F-Secure
Gen:Variant.Application.Bundler
11.2015-04-08_3

G Data
Gen:Variant.Application.Bundler.Amonetize.18
15.8.25

K7 AntiVirus
Unwanted-Program
13.204.16065

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.1632

Malwarebytes
PUP.Optional.Amonetize
v2015.08.04.03

McAfee
PUP-FQT
5600.6683

MicroWorld eScan
Gen:Variant.Application.Bundler.Amonetize.18
16.0.0.648

NANO AntiVirus
Riskware.Win32.Downware.dfqeij
0.30.24.1636

nProtect
Trojan-Clicker/W32.Amonetize.395376
15.05.28.01

Panda Antivirus
Trj/CI.A
15.08.04.03

Quick Heal
Trojan.Neop.G5
8.15.14.00

Reason Heuristics
PUP.Amonetize.ShetefSolutionsConsulting1998.Bundler (M)
15.8.4.15

Rising Antivirus
PE:Trojan.Win32.Generic.17723888!393361544
23.00.65.15802

Sophos
Generic PUA IE
4.98

Total Defense
Win32/Tnega.JBJQCMD
37.1.62.1

Trend Micro House Call
TROJ_SPNR.0BJD14
7.2.216

Trend Micro
TROJ_SPNR.0BJD14
10.465.04

Vba32 AntiVirus
AdWare.Amonetize
3.12.26.4

VIPRE Antivirus
Trojan.Win32.Generic
40644

Zillya! Antivirus
Adware.Amonetize.Win32.1272
2.0.0.2193

File size:
386.1 KB (395,376 bytes)

Product version:
1.1.5.26

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\elements of photogrammetry wit downloader__3687_i1349582980_il685640.exe

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Authority:
COMODO CA Limited

Valid from:
9/26/2014 3:30:00 AM

Valid to:
9/27/2015 3:29:59 AM

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., POBox=43568, STREET=21 Hatlalim St., L=Rannana, S=Rannana, PostalCode=43568, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009E472EA7B4ADB461EB35F9F783DA3438

File PE Metadata
Compilation timestamp:
9/17/2014 12:52:23 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:KZ2KRA+AqItby06N9DejUmbKdxjjg8ESkb4vN8fmzYX6fwkpo6iu04bIGW:WRASmmZVejUWKLjjg8EchdoDuWGW

Entry address:
0x14CC0

Entry point:
E8, 53, 6A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 44, 5E, 3C, 00, 00, 75, 18, E8, D1, 60, 00, 00, 6A, 1E, E8, 1B, 5F, 00, 00, 68, FF, 00, 00, 00, E8, B6, F4, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 44, 5E, 3C, 00, FF, 15, 58, D1, 3B, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 44, 5E, 3C, 00, 00, 75, 18, E8, 87, 60, 00, 00, 6A, 1E, E8, D1, 5E, 00, 00, 68, FF, 00, 00, 00, E8, 6C, F4, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Entropy:
7.3185

Code size:
174 KB (178,176 bytes)

The file elements of photogrammetry wit downloader__3687_i1349582980_il685640.exe has been seen being distributed by the following URL.

http://best.download010.perso.sfr.fr/.../sam__2268_il1604.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.