home

hallmark the good witch s dest downloader__3687_i485776761_il6005164.exe

The application hallmark the good witch s dest downloader__3687_i485776761_il6005164.exe has been detected as a potentially unwanted program by 5 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from ad.propellerads.com and multiple other hosts.
Version:
1.1.5.26

MD5:
a4ce95562e6213c30c85421864f8f1c5

SHA-1:
1cf4a8add194ecb57557f306449f7b2fb4286af9

SHA-256:
e4b9277bb9395010e24832aaf16cfda35dcd8f05862a81cae2347a9f58571528

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 2:16:02 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
14.03.24

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.138.182

Malwarebytes
PUP.Optional.Amonetize.A
v2014.03.24.07

Reason Heuristics
Threat.Win.Reputation.IMP
14.3.31.14

Trend Micro House Call
TROJ_GEN.F47V0324
7.2.83

File size:
319 KB (326,656 bytes)

Product version:
1.1.5.26

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
3/24/2014 8:50:20 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:pFmb3/Y3lo74cdaBMmXOBb9hL9xje3K67RfsIL7FjtxXEBH0p+z/3s/BH:pFmb3/YVo74wDmXub95KfF7FYh0UOB

Entry address:
0x27084

Entry point:
E8, F4, 89, 00, 00, E9, 89, FE, FF, FF, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00...
 
[+]

Entropy:
6.4191

Code size:
226 KB (231,424 bytes)

The file hallmark the good witch s dest downloader__3687_i485776761_il6005164.exe has been seen being distributed by the following 16 URLs.

http://ad.propellerads.com/ck.php?oaparams=2__bannerid=95328__zoneid=20435__OXLCA=1__cb=d25fabb92a__oadest=http://.../?id=p191&sub=ar&name=File.Download&nor=1&subid=${SUBID}

http://bit.ly/1itUyOI

http://www.singulardownload.com/download.php?version=1.1.5.26&campid=7171&instid[appname]=Video Player&instid[appsetupurl]=https://youtubevv.googlecode.com/svn/trunk/VideoPlayerv23.1.2.exe&instid[cmdline]=NSIS = /S Inno Setup= /VERYSILENT &instid[appimageurl]=http://1.bp.blogspot.com/-h4IuAwQAYF8/Uy1Giy4OVFI/AAAAAAAABis/Z98BqhvI-IA/s150/flash_player_10_mnemonic_no_shadow3.png&prefix=Video Player&instid[thankyoupage]=https://cracks4free.info/.../ty.html

http://bit.ly/a/warning?url=http://www.singulardownload.com/download.php?version=1.1.5.26&campid=7171&instid[appname]=Video Player&instid[appsetupurl]=https://youtubevv.googlecode.com/svn/trunk/VideoPlayerv23.1.2.exe&instid[cmdline]=NSIS = /S Inno Setup= /VERYSILENT &instid[appimageurl]=http://1.bp.blogspot.com/-h4IuAwQAYF8/Uy1Giy4OVFI/AAAAAAAABis/Z98BqhvI-IA/s150/flash_player_10_mnemonic_no_shadow3.png&prefix=Video Player&instid[thankyoupage]=https://cracks4free.info/.../ty.html&hash=1itUyOI

http://www.averagedownload.com/download.php?campid=6666&version=1.1.5.26&instid[appname]=Modern Combat 4 Zero Hour MOD APK DATA(Unlimited Credits) v1.1.0&instid[appsetupurl]=http://www.myutility.com/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://downloadforall.net/.../downloadall.png&prefix=Modern Combat 4 Zero Hour MOD APK DATA(Unlimited Credits) v1.1.0&instid[thankyoupage]=http://www.downloadforall.net/.../thankyou.php&ti1=MTI4MnwzNjc5fFBIfDN8MXx8|6cb23ca7a52948f5ea92efd9176a5bd7

http://www.prudentdownload.com/download.php?version=1.1.5.26&campid=6183&instid[appname]=S4 League Hackshield Kurulum&instid[appsetupurl]=http://www.tvce.net/dosyalar/New-Version.exe&instid[cmdline]=&instid[appimageurl]=http://.../resim/files.png&prefix=S4 League Hackshield&instid[thankyoupage]=http://.../git.php?k=myhile.com

http://www.specificdownload.com/download.php?version=1.1.5.26&campid=2299&instid[appsetupurl]=&instid[appname]=File.Download&instid[appimageurl]=http://.../dl.png&prefix=File.Download&ti1=p191.ar.0.results.325a0524600&ti2=4906309735

http://dlforall.net/.../?id=p191&sub=ar&name=File.Download&nor=1&subid=4906309735

http://dl-gate.net/?id=p191&sub=ar&name=File.Download&nor=1&subid=4906309735

http://www.effortlessdownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=ClashOfClansHack2014 Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1780797304.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=ClashOfClansHack2014 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1780797304

http://www.singulardownload.com/download.php?version=1.1.5.26&campid=6629&instid[appname]=SoundCloudDownloader&instid[appsetupurl]=http://download.freesoftindex.com/software/SoundCloudDownloader_Setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.freesoftindex.com/img/150x150/soundcloud.png&prefix=SoundCloudDownloader&instid[thankyoupage]=http://.../finish.php&ti1=4951-0-soundcloud

http://www.downloadsoundcloud.net/.../49510

http://www.effortlessdownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Free Adobe Photoshop Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1631635994.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Free Adobe Photoshop Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1631635994

http://www.effortlessdownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Photoshop CS6 Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1057727991.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Photoshop CS6 Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1057727991

http://www.effortlessdownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Bangbros Account Generator Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1382194440.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Bangbros Account Generator Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1382194440

http://www.effortlessdownload.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Hallmark The Good Witch S Destiny 2013 Download Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1145875467.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Hallmark The Good Witch S Dest Downloader&instid[thankyoupage]=http://.../?success&instid[interrupted]=http://.../?cancel&ti1=1145875467

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.