home

ghetto streetz__5008_il553141.exe

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application ghetto streetz__5008_il553141.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Shetef Solutions & Consulting (1998) Ltd.  (signed and verified)

Version:
1.1.5.86

MD5:
b04bad49524bfcb3132e83e23eade82d

SHA-1:
1ff224e8c948782fd038745d7fe228bd0edeaa5f

SHA-256:
4eaab7f4846e585dac7f99f3046aaf8d1b7028fa817adc5904845dd325d7c953

Scanner detections:
20 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 8:26:15 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Amonetize.21
6357193

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2015.01.20

Avira AntiVirus
ADWARE/Adware.Gen4
7.11.203.36

avast!
Win32:Amonetize-FT [PUP]
150102-1

AVG
Generic
2016.0.3224

Bitdefender
Gen:Variant.Application.Bundler.Amonetize.21
1.0.20.95

Dr.Web
Adware.Downware.8996
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Amonetize.21
9.0.0.4799

ESET NOD32
Win32/Amonetize.BY potentially unwanted application
7.0.302.0

F-Secure
Riskware.Gen:Variant.Application.Bundler
5.13.68

G Data
Gen:Variant.Application.Bundler.Amonetize.21
15.1.24

K7 AntiVirus
Unwanted-Program
13.191.14689

Malwarebytes
PUP.Optional.Amonetize
v2015.01.19.09

MicroWorld eScan
Gen:Variant.Application.Bundler.Amonetize.21
16.0.0.57

NANO AntiVirus
Riskware.Win32.Downware.difhzb
0.30.0.64448

Norman
Gen:Variant.Application.Jaik.4831
03.12.2014 13:20:04

Reason Heuristics
PUP.Installer.ShetefSolutionsConsulting1998
15.1.19.20

Vba32 AntiVirus
AdWare.Amonetize
3.12.26.3

Zillya! Antivirus
Adware.Amonetize.Win32.1605
2.0.0.2039

File size:
486.1 KB (497,744 bytes)

Product version:
1.1.5.86

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Authority:
GoDaddy.com, Inc.

Valid from:
10/13/2014 5:02:37 AM

Valid to:
10/13/2015 5:02:37 AM

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B1B72BCEFC0E8

File PE Metadata
Compilation timestamp:
10/29/2014 6:41:41 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:NLFU2oitpf5hCPFZYdfUUn1PvhJQBtOFdEvZl3:N2ztZYRUWhJQBQTKZl3

Entry address:
0x13CF6

Entry point:
E8, A8, 75, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, BC, A1, 3B, 00, 00, 75, 18, E8, 5E, 4E, 00, 00, 6A, 1E, E8, A8, 4C, 00, 00, 68, FF, 00, 00, 00, E8, 60, F5, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, BC, A1, 3B, 00, FF, 15, F8, 10, 3B, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, BC, A1, 3B, 00, 00, 75, 18, E8, 14, 4E, 00, 00, 6A, 1E, E8, 5E, 4C, 00, 00, 68, FF, 00, 00, 00, E8, 16, F5, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Entropy:
7.3795

Code size:
191 KB (195,584 bytes)

The file ghetto streetz__5008_il553141.exe has been seen being distributed by the following URL.

http://www.limitlessdownload.com/download.php?version=1.1.5.86&campid=5008&instid[appname]=Ghetto Streetz&instid[appsetupurl]=http://www.fontastico.com/storage/archives/11792.zip&instid[appimageurl]=https://s3.amazonaws.com/free-sw/Rounded-Download-Button-150x150.jpg&prefix=Ghetto Streetz&instid[thankyoupage]=http://fontastico.com/thankyou/&instid[cmdline]=%HOMEPATH%/.../Fontastico&ti1=&ti2=&ti3=

Remove ghetto streetz__5008_il553141.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.