home

freeyoutubedownload.exe

CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti

The application freeyoutubedownload.exe by CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Sti has been detected as adware by 2 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from www.tamindir.com and multiple other hosts.
Publisher:
CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti  (signed and verified)

Version:
1, 1, 0, 0

MD5:
8dc53c2d4c6a60227e6b92214f8427cf

SHA-1:
fb619fb2bbb40143bc0fce86590529deb73e3a2e

SHA-256:
24738135c78881068677923ed4fe34e7d23383d1c16a1f539a3e58afe09fc894

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
11/27/2024 1:47:15 AM UTC  (today)

Scan engine
Detection
Engine version

Malwarebytes
PUP.Optional.FreeGames
v2014.04.25.05

Reason Heuristics
PUP.CNTBilisimTeknolojisipazrekturltlhTicSti.T
14.8.8.0

File size:
537.3 KB (550,240 bytes)

File type:
Executable application (Win32 EXE)

Language:
Ingilizce (Birlesik Krallik)

Common path:
C:\users\{user}\downloads\freeyoutubedownload.exe

Digital Signature
Signed by:
CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti

Authority:
COMODO CA Limited

Valid from:
2/2/2012 2:00:00 AM

Valid to:
2/2/2014 1:59:59 AM

Subject:
CN=CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti, OU=CNT Bilisim Teknolojisi Tic Ltd Sti, O=CNT Bilisim Teknolojisi pazrek tur lt lh Tic. Ltd. Sti, STREET=273/1 Sk. Mansuroglu Mah. Narlibahce Sit., STREET=No:6 B1 Blok Daire:2, STREET=Bayrakli, L=Caner Bayraktar, S=Izmir, PostalCode=35030, C=TR

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2491AD8A2DE204BEAB2DC62493BE62FA

File PE Metadata
Compilation timestamp:
1/29/2012 11:32:28 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:a6Wq4aaE6KwyF5L0Y2D1PqLfc8x2HcezkMkBgmcRjZb:4thEVaPqLfc22Hbzk7BgmcVF

Entry address:
0xB2E80

Entry point:
60, BE, 00, 10, 47, 00, 8D, BE, 00, 00, F9, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
268 KB (274,432 bytes)

The file freeyoutubedownload.exe has been seen being distributed by the following 5 URLs.

http://www.tamindir.com/indir/MjAxMy0wOC0yNyAxNjowMTozOQ==/youtube-download/windows/.../

http://depo.indir.so/.../FreeYoutubeDownload.exe

http://www.tamindir.com/indir/MjAxMy0xMC0yMSAxNjo0OTo0OA==/youtube-download/windows/.../

http://www.tamindir.com/indir/MjAxMy0xMi0yNiAxMzoyMDoxMw==/youtube-download/.../3.2.9.725

http://www.tamindir.com/indir/MjAxMy0wOC0zMSAxMToyMToxOA==/youtube-download/windows/.../

Remove freeyoutubedownload.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.