home

installercjk__7934_il27562.exe

Domains and hosting LLC

The application installercjk__7934_il27562.exe by Domains and hosting has been detected as adware by 21 anti-malware scanners. This is a setup program which is used to install the application. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from v4download.com and multiple other hosts.
Publisher:
Domains and hosting LLC  (signed and verified)

Version:
1.1.5.90

MD5:
e63a990f207d5286e8950f088ff3a9c3

SHA-1:
2be887174dff2fe39c78b03d48be1b4c6f3286a1

SHA-256:
117c00ab3f9da10fb039031d0473079350e1c8d8b17688bffa0772db2bef5939

Scanner detections:
21 / 68

Status:
Adware

Analysis date:
12/25/2024 1:13:34 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Strictor.77177
724

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2015.02.11

Avira AntiVirus
ADWARE/Adware.Gen4
7.11.209.122

Bitdefender
Gen:Variant.Adware.Strictor.77177
1.0.20.205

Comodo Security
Application.Win32.Amonetize.DE
21034

Dr.Web
Trojan.Amonetize.441
9.0.1.041

Emsisoft Anti-Malware
Gen:Variant.Adware.Strictor.77177
8.15.02.10.09

ESET NOD32
Win32/Amonetize.DE potentially unwanted (variant)
9.11156

Fortinet FortiGate
Adware/Amonetize
2/10/2015

F-Secure
Gen:Variant.Adware.Strictor.77177
11.2015-10-02_3

G Data
Gen:Variant.Adware.Strictor.77177
15.2.25

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.2505

Malwarebytes
PUP.Optional.Amonetize
v2015.02.10.09

McAfee
GenericR-CXP!E63A990F207D
5600.6858

MicroWorld eScan
Gen:Variant.Adware.Strictor.77177
16.0.0.123

NANO AntiVirus
Trojan.Win32.Amonetize.dnjxrs
0.30.0.65070

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Domainsandhosting
15.2.14.11

Sophos
Generic PUA CL
4.98

Zillya! Antivirus
Adware.Amonetize.Win32.2183
2.0.0.2062

File size:
639.5 KB (654,880 bytes)

Product version:
1.1.5.90

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Digital Signature
Signed by:
Domains and hosting LLC

Authority:
COMODO CA Limited

Valid from:
2/9/2015 1:00:00 AM

Valid to:
2/10/2016 12:59:59 AM

Subject:
CN=Domains and hosting LLC, O=Domains and hosting LLC, STREET=Street Khmelnytsky Highway 114, L=Vinnycya, S=Vinnycka, PostalCode=21029, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
32B570B832950A992CE17C1FFA5C7670

File PE Metadata
Compilation timestamp:
1/29/2015 4:40:05 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:WRvec5T/QTBzse3S0C9+YxZfbj0F/iKtpDbWR+NDehZE:Wpec5ToTBzs0S0NmtMF/nyR+Ehe

Entry address:
0xDEB8

Entry point:
E8, C1, 4A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, EC, 1E, 38, 00, 00, 75, 18, E8, 9F, 34, 00, 00, 6A, 1E, E8, E9, 32, 00, 00, 68, FF, 00, 00, 00, E8, F0, F8, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, EC, 1E, 38, 00, FF, 15, 9C, 70, 37, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, EC, 1E, 38, 00, 00, 75, 18, E8, 55, 34, 00, 00, 6A, 1E, E8, 9F, 32, 00, 00, 68, FF, 00, 00, 00, E8, A6, F8, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Code size:
148.5 KB (152,064 bytes)

The file installercjk__7934_il27562.exe has been seen being distributed by the following 3 URLs.

http://v4download.com/download.php?id=thequeash&title=WoT-Loretai-Mods

http://v4download.com/download.php?id=thequeash&title=WoT-Aslains-Mods

http://downloadmee.com/download.php?id=simonaslietuva&title=Setup

Remove installercjk__7934_il27562.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.