home

itunes-download-canada-windows-7_downloader.exe

YourFileDownloader Installer

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application itunes-download-canada-windows-7_downloader.exe by Via Advertising Group Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the YourFile Downloader installer. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
http://yourfile-downloader.com  (signed by Via Advertising Group Limited)

Product:
YourFileDownloader Installer

Version:
1, 0, 509, 1

MD5:
338e0fb938f97960e51a3ec40528252a

SHA-1:
f93c38e8969da5bb5ee52df6ca60a1662553380e

SHA-256:
4fca6bd80f29e631c7101cbb2a6e64e1dbf018338466827ff28734124e668777

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/14/2024 9:16:25 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Via Advertising.ViaAdver.Bundler (M)
16.6.2.8

File size:
3.8 MB (3,968,240 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\itunes-download-canada-windows-7_downloader.exe

Digital Signature
Signed by:
Via Advertising Group Limited

Authority:
COMODO CA Limited

Valid from:
4/11/2013 8:00:00 PM

Valid to:
4/11/2016 7:59:59 PM

Subject:
CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BABC309174F531C6762BBA466401FEAF

File PE Metadata
Compilation timestamp:
1/23/2015 5:55:09 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:z4uZhR5BEC9PNyGQylE3g+Q/k0PBWgtWL59+N:zPZKAPN6yQRQ/RP7tWL5UN

Entry address:
0x453E26

Entry point:
9C, 60, C7, 44, 24, 20, D6, BA, 54, B3, 68, 5E, 2E, D6, 2E, E9, 17, A9, FE, FF, 00, 00, 53, 48, 43, 68, 61, 6E, 67, 65, 4E, 6F, 74, 69, 66, 79, 00, 68, 75, FA, ED, D3, F8, 60, D3, E0, C7, 04, 24, 16, BC, AA, 9B, FF, 74, 24, 08, 9C, E9, A7, 29, 04, 00, F3, 77, BF, 44, 1D, 9A, EE, 3C, E5, 95, C9, 4B, 6F, FB, EC, 5C, 20, 81, 48, D6, 98, 8E, D4, DC, 8D, AA, BB, 9C, 5D, 41, 89, FC, C1, B0, F5, 7A, AA, 53, AA, 7A, 62, B3, FA, 21, B7, AB, B2, 04, 4B, 4D, 54, 95, 72, 17, B1, 00, D1, EA, 9B, 4E, 26, CF, 65, 69, AA...
 
[+]

Entropy:
7.9051  (probably packed)

Code size:
786 KB (804,864 bytes)

The file itunes-download-canada-windows-7_downloader.exe has been seen being distributed by the following URL.

http://dll513.yfdownloader.net/j5GsY3ferEgr8KJIZNS ImqRliZ8ob0qO5O0IX6nliAz 8MjUe3YbxTi3moZ6sVXCK ABVuExFoG1MlXD9wnA1 ecRknglYSIsk WT6KcOUolXbYJnlp7ms8O w2YUL4Yz0D4wZjdvMJZ1miHnBUwgpvW8IGDlrEGwJJywl3ItwLQjHF w0K qBGKN7mZzKv518 mPwvZPuwMDm8xSER7qh7S abY0fqkmBD6pJ BILxNBSU2l1Pj4JQGI7YXrCX3QqwlfMWuZ7wEuzHrE6kOvsZ8Daw479 t7nUSvzkxi674oN0g SUL8Dk33CO7dJXsfXRGsCGy0qYwIAeypH5C9jY F8k26xCO4P9BzrdsyA8irQjJKToeCKm7Sko tcyfanTYUaz2z5A

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.