» hdfilm.exe
Overview
Analysis
File Details
Downloads (1)

hdfilm.exe

eDownload Module

Banyan Tree Technology Limited

The application hdfilm.exe by Banyan Tree Technology Limited has been detected as adware by 15 anti-malware scanners. This is a setup program which is used to install the application. This is an adware bundler (AKA ElexNetDownload) that will include additional unwanted offers in the download and install process. During install it will establish a connection to twonext.com and xingcloud.com to determine what offers to show the user (based on what is already installed and where they live).The file has been seen being downloaded from dl.elex.soft365.com.

File name:

hdfilm.exe

Publisher:

Banyan Tree Technology Limited (signed and verified)

Product:

eDownload Module

Version:

5.1.8.2544

MD5:

bac657eb3850dcea38e4145b703f958c

SHA-1:

bfe6a0da9829c69f11f04fd1667e1eeeeac9181a

SHA-256:

912b5c2c11d558eacfb530dba82a3a0087b19e4cc31e3dd315f46c58c89665e2

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Software bundler and update mechanism that will attempt to install adware offers.

Analysis date:

12/24/2024 3:43:52 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.138.30

avast!

Win32:Adware-BEM [Adw]

2014.9-140618

AVG

MalSign.Generic

2015.0.3440

Baidu Antivirus

Adware.Win32.ElexInstall

4.0.3.14618

Bkav FE

W32.Clod2a1.Trojan

1.3.0.4923

Dr.Web

Adware.Mutabaha.23

9.0.1.0169

Emsisoft Anti-Malware

Trojan.Win32.ELEX.AMN

8.14.06.18.06

ESET NOD32

Win32/ELEX (variant)

8.9176

G Data

Win32.Adware.Elex

14.6.24

IKARUS anti.virus

AdWare.Win32.ELEX

t3scan.2.2.29

Malwarebytes

PUP.Optional.Elex

v2014.06.18.06

McAfee

Artemis!9F28656AB0CE

5600.7096

Reason Heuristics

PUP.BanyanTreeTechnologyLimited.G

14.6.18.6

Trend Micro House Call

TROJ_GEN.F47V0724

7.2.169

VIPRE Antivirus

Elex Installer

24412

File size:

516.6 KB (528,992 bytes)

Product version:

5.1.8.2544

Original file name:

eDownload.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\hdfilm.exe

Digital Signature

Signed by:

Banyan Tree Technology Limited

Authority:

GlobalSign nv-sa

Valid from:

1/10/2013 7:18:54 AM

Valid to:

1/11/2015 7:18:54 AM

Subject:

CN=Banyan Tree Technology Limited, O=Banyan Tree Technology Limited, L=HongKong, S=HongKong, C=HK

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121C63E4490F9D28667737C8DE7D3B6805D

File PE Metadata

Compilation timestamp:

7/9/2013 5:51:42 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:Tf+fb5J8InywWLMsil2f1lz3r56NmoS50SUNnjsqhTL2eyKd:QfnjqMsilUb9hUNnjBhgKd

Entry address:

0xF28D0

Entry point:

60, BE, 00, 80, 49, 00, 8D, BE, 00, 90, F6, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA]

Code size:

364 KB (372,736 bytes)

The file hdfilm.exe has been seen being distributed by the following URL.

http://dl.elex.soft365.com/.../generator?short=ss_643_6f3378f97b621c3490e1f0dd9b8aa162

Remove hdfilm.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.