» going home midi file__3038_i1388108952_il656778.exe
Overview
Analysis
File Details
Downloads (2)

going home midi file__3038_i1388108952_il656778.exe

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application going home midi file__3038_i1388108952_il656778.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.

File name:

Publisher:

Shetef Solutions & Consulting (1998) Ltd. (signed and verified)

Version:

1.1.8.22

MD5:

ec94270fa6046a71670c373769e851dc

SHA-1:

c25568b0c49718373ce2620f12bcca3b4c64b144

SHA-256:

8ffc0a28101c93b2f718cfa9c2494d76e41942eff7580211f250db24df69490e

Scanner detections:

22 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

2/25/2025 1:50:01 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Graftor.161610

830

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetize

2014.10.28

Avira AntiVirus

Adware/Amonetize.519376.14

7.11.181.132

avast!

Win32:Amonetize-FM [PUP]

2014.9-141029

AVG

Ukra

2015.0.3307

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.141029

Bitdefender

Gen:Variant.Adware.Graftor.161610

1.0.20.1505

Dr.Web

Adware.Downware.8876

9.0.1.0301

Emsisoft Anti-Malware

Gen:Variant.Adware.Graftor.161610

8.14.10.28.10

ESET NOD32

Win32/Amonetize.BW (variant)

8.10632

Fortinet FortiGate

Adware/Amonetize

10/29/2014

F-Prot

W32/A-6c30e7fe

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.Graftor.161610

11.2014-28-10_3

G Data

Gen:Variant.Adware.Graftor.161610

14.10.24

Kaspersky

not-a-virus:AdWare.Win32.Amonetize

14.0.0.3028

Malwarebytes

PUP.Optional.Amonetize

v2014.10.28.10

McAfee

Artemis!00007E9365A6

5600.6963

MicroWorld eScan

Gen:Variant.Graftor.161218

15.0.0.903

NANO AntiVirus

Riskware.Win32.Downware.dhaxhs

0.28.2.62841

Reason Heuristics

PUP.Installer.ShetefSolutionsConsulting1998.p

14.10.28.10

Sophos

Amonetize

4.98

File size:

453.6 KB (464,464 bytes)

Product version:

1.1.8.22

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\going home midi file__3038_i1388108952_il656778.exe

Digital Signature

Signed by:

Shetef Solutions & Consulting (1998) Ltd.

Authority:

GoDaddy.com, Inc.

Valid from:

10/13/2014 3:02:37 AM

Valid to:

10/13/2015 3:02:37 AM

Subject:

CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4B1B72BCEFC0E8

File PE Metadata

Compilation timestamp:

10/20/2014 8:33:52 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:RIc0x8bs/GQY5quuE708/r1GGi1D+9dlfVI:RIvKbhR77D1GfcdhVI

Entry address:

0x11DE8

Entry point:

E8, 49, 6A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 94, 1E, 3B, 00, 00, 75, 18, E8, 5C, 4E, 00, 00, 6A, 1E, E8, A6, 4C, 00, 00, 68, FF, 00, 00, 00, E8, F9, F5, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 94, 1E, 3B, 00, FF, 15, 14, A1, 3A, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 94, 1E, 3B, 00, 00, 75, 18, E8, 12, 4E, 00, 00, 6A, 1E, E8, 5C, 4C, 00, 00, 68, FF, 00, 00, 00, E8, AF, F5, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3... 
[+]

Entropy:

7.4119

Code size:

161 KB (164,864 bytes)

The file going home midi file__3038_i1388108952_il656778.exe has been seen being distributed by the following 2 URLs.

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3515&instid[appname]=micromax a35 usb driver_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1405000&ti2=2&ti3=DD1_2014-10-28T13:25:46.497145 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=micromax a35 usb driver&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-28T13:25:46.497145 00:00&parameter=micromax a35 usb driver&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-28T13:25:46.497145 00:00&parameter=micromax a35 usb driver&ti1=1405000&ti2=2&ti3=DD1_2014-10-28T13:25:46.497145 00:00

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=bi bi heavy expanded font_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1405000&ti2=2&ti3=DD1_2014-10-28T14:00:04.472546 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=bi bi heavy expanded font&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-28T14:00:04.472546 00:00&parameter=bi bi heavy expanded font&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-28T14:00:04.472546 00:00&parameter=bi bi heavy expanded font&ti1=1405000&ti2=2&ti3=DD1_2014-10-28T14:00:04.472546 00:

Remove going home midi file__3038_i1388108952_il656778.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.