home

installer_jdownloader_english.exe

The executable installer_jdownloader_english.exe has been detected as malware by 36 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from download.secure.edgesuite.net and multiple other hosts.
MD5:
1514a9fc1a6c9adefe1e7d3af0d5bf9f

SHA-1:
75d5e559beea8dd27bccf9dd5a67bca011661592

SHA-256:
18865efded85d2a125bf6d7b4169470aa3627f9fd1718402878e5b6d852c3236

Scanner detections:
36 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
11/27/2024 8:59:30 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
6143770

Agnitum Outpost
Win32.Sality.BL
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2014.12.16

Avira AntiVirus
W32/Sality.AT
7.11.195.250

avast!
Win32:SaliCode
141214-1

AVG
Win32/Sality
2014.0.4189

Baidu Antivirus
Virus.Win32.Sality.$Emu
4.0.3.141216

Bitdefender
Win32.Sality.3
1.0.20.1750

Bkav FE
W32.Sality.PE
1.3.0.6267

Comodo Security
Virus.Win32.Sality.Gen
20383

Dr.Web
Win32.Sector.22
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
9.0.0.4668

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.13.68

G Data
Win32.Sality
14.12.24

IKARUS anti.virus
Virus.Win32.Sality
t3scan.1.8.5.0

K7 AntiVirus
Virus
13.187.14339

Kaspersky
Virus.Win32.Sality
15.0.0.543

McAfee
Trojan.Artemis!6593DF939E1A
16.8.708.2

Microsoft Security Essentials
Threat.Undefined
1.189.2207.0

MicroWorld eScan
Win32.Sality.3
15.0.0.1050

NANO AntiVirus
Virus.Win32.Sality.beygb
0.28.6.64267

Norman
Win32.Sality.3
04.12.2014 14:30:06

nProtect
Virus/W32.Sality.D
14.12.15.01

Panda Antivirus
W32/Sality.AA
14.12.16.02

Qihoo 360 Security
Malware.QVM19.Gen
1.0.0.1015

Quick Heal
W32.Sality.U
12.14.14.00

Rising Antivirus
PE:Win32.KUKU.kt!1591113
23.00.65.141214

Sophos
Virus 'Mal/Sality-D'
5.08

Total Defense
Win32/Sality.AA
37.0.11332

Trend Micro House Call
PE_SALITY.RL
7.2.350

Trend Micro
PE_SALITY.RL
10.465.16

Vba32 AntiVirus
Virus.Win32.Sality.bakc
3.12.26.3

VIPRE Antivirus
Threat.4721115
35418

ViRobot
Win32.Sality.N[h]
2014.3.20.0

File size:
861.5 KB (882,224 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer_jdownloader_english.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:jKFcsDsENy3+ZSijrkfj0NF3I1zG8gnqZuDUYp799Sp:jYpUrijrkfjOF41hgq4UYD8

Entry address:
0x9C40

Entry point:
0A, D2, 2C, 6C, F6, C1, A3, C7, C1, FF, 00, D1, E6, 69, C8, EB, 8A, A3, 03, B7, F4, BE, 1B, D5, AC, B5, 86, CB, 68, 10, AA, DA, 00, 68, C7, 1B, FB, 00, 0F, BE, D1, E8, 00, 00, 00, 00, 5B, 0F, B7, CD, 74, 09, 69, F0, 02, 66, 82, BF, C6, C6, AC, F6, C0, 48, F2, B2, 28, 0F, BE, C2, 8D, 0D, E7, 0B, 26, 02, 8D, 2D, 67, 74, 14, 64, 81, E6, A9, 03, 04, A5, BA, D5, CD, 07, 00, 0F, BE, C9, 81, F2, 7A, 39, 00, 00, 8D, 35, 92, BE, DD, 10, 0B, C6, 13, C3, 81, F2, AA, 0A, 00, 00, 80, F5, 9E, 8B, CE, C7, C1, CB, 0D, 0B...
 
[+]

Entropy:
7.9011  (probably packed)

Code size:
37 KB (37,888 bytes)

The file installer_jdownloader_english.exe has been seen being distributed by the following 7 URLs.

http://download.secure.edgesuite.net/installers/axtan_installers/get.php?aa=lp/1/seo//&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&p=U0VP&r=8490780&loop=5&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&EF=100&EJ=46&KE=84&GD=73&ID=22&IL=24&CJ=21&BE=18&LD=42&CF=99&t=1418190151&s=373631084610437565789728550764702065274636679335913986741818388595112686253197788087761842770530142300035345113922698783050114128369462907419801171959255366788614550850502492600705720267845707253248399638809879442468252723449773612576466354398545460733088966238596232978308162708872281178701661285572413239500

http://download.instseo.com/installers/axtan_installers/get.php?aa=lp/1/seo//&loop=4&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&p=U0VP&r=8652008&JK=6&BF=97&HB=93&CI=37&DL=60&MA=73&CG=31&CB=14&BN=48&FH=97&s=617752978157172383328327784099061746033849666895127960748158154239832227183873396183157072888301295418237614953672988795974804023675499151657014203072670061563921571496652353784082350356403896043192858083461960105131882261866286561379716902022646724941138856402549511112414778351745968744384638690701053421256430927891239793652733838

http://download.instseo.com/installers/axtan_installers/get.php?aa=lp/1/seo//&r=780338&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&p=U0VP&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&loop=3&KN=11&GM=8&JB=54&BF=20&IA=52&GH=100&ND=25&CJ=58&KA=43&AI=82&s=017504617212715982088193343608409150611442624112420330774134975891953097369781023167134647135624710029856734947353077531345807389391377950454180597240475966795634762568514022082807945441111674051308169662870161856300511679184315131198386492588118260337246777291300249889047969886819643221041182206285199996874456421853058176397015535

http://download.instseo.com/installers/axtan_installers/get.php?aa=lp/1/seo//&loop=2&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&r=1553128&p=U0VP&GB=85&DK=15&ME=60&JA=3&IM=42&BN=76&KI=29&GD=3&AE=25&s=0071240610026936790903819857169167291252355058627728109085802818548673909404277049850868449630585352643684011816791788623586634169334792103285855033905253827333376746066484970483773309682325753438034673071019497827896039615958851229636738788470250953825320206438392065944781717812295737867400340556140519791472792276952793837882506667636784

http://download.instseo.com/installers/axtan_installers/get.php?aa=lp/1/seo//&loop=1&p=U0VP&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&r=4224141&EG=55&GH=84&JL=15&FE=95&DJ=57&EC=73&JJ=85&HM=15&HJ=0&FC=58&s=730287029393469965696288135055539558360290547543113731655151714679405525689443854138393918089456406969528473858262002393292138888485438275650487797936356579458306859676132281960754389947993723308376090219305481819814513896226164763884725273465346808297820536012391874301748283964893586549241481668008272100407886245800824973039949777

http://download.secure.edgesuite.net/installers/axtan_installers/get.php?aa=lp/1/seo//&ua=chrome&u=L2Rvd25sb2FkLmluc3RzZW8uY29tL2luc3RhbGxlcnMvb3V0LzAxMjA5MDEyMTAwMTIxMS9waWlkLTAxMjM0NTY3ODk5ODc0NTYzMjEwMDEyMzQ1Njc4OTEyL2xwLzEvc2VvL2VuZ2xpc2gvc2VvL2Nocm9tZS9qZG93bmxvYWRlci9kLzc4MjE5ODAyN2ZjNTA5NGM0NzlkM2VmOWE0M2IyMmI1L2ljaS9uYS9uYS9pbnN0YWxsZXJfamRvd25sb2FkZXJfRW5nbGlzaC5leGU=&p=U0VP&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9scC8xL3Nlby9lbmdsaXNoL3Nlby9jaHJvbWUvamRvd25sb2FkZXIvZC83ODIxOTgwMjdmYzUwOTRjNDc5ZDNlZjlhNDNiMjJiNS9pY2kvbmEvbmEvaW5zdGFsbGVyX2pkb3dubG9hZGVyX0VuZ2xpc2guZXhl&loop=0&s=17031475555268035174655246898329132370835351264772248763452295208536520055282659974751107336956700462468996162150635745489074755792039838454679633208857755230700904897743110183514399075698679770160834245264615154152711688556662656171707178683109371530486053318926097714683093030293232847289172781562920330644663097282001918197343646779833200619437747849768492766334327748719763537322

http://www.jdownloader.com/download

Remove installer_jdownloader_english.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.