home

kotonoha no hana cd__3038_i1320714092_il1583278.exe

Ukra-2006 LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application kotonoha no hana cd__3038_i1320714092_il1583278.exe by Ukra-2006 has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from www-squid.cluster11.fb-hosting-apps.com and multiple other hosts.
Publisher:
Ukra-2006 LLC  (signed and verified)

Version:
1.1.8.22

MD5:
dd141fc5eea1d40350eb995bc7ea5342

SHA-1:
049b1399dce697b6227dd57f05939f3c36d21832

SHA-256:
045d4b13eb1546c9996fb1c8bff247040e7e8bfa41c3fa184617f85630610a39

Scanner detections:
14 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/27/2024 4:35:24 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetize
2014.09.21

Avira AntiVirus
ADWARE/Adware.Gen
7.11.173.134

AVG
Downloader.Generic14
2015.0.3305

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141030

Dr.Web
Adware.Downware.8564
9.0.1.0303

ESET NOD32
Win32/Amonetize.BO (variant)
8.10445

Fortinet FortiGate
Riskware/Amonetize
10/30/2014

K7 AntiVirus
Unwanted-Program
13.183.13432

Malwarebytes
PUP.Optional.Amonetize
v2014.10.30.12

McAfee
RDN/Generic.dx!df3
5600.6961

NANO AntiVirus
Riskware.Win32.Amonetize.dffaha
0.28.2.62151

Reason Heuristics
PUP.Installer.Ukra2006.p
14.10.30.11

Sophos
Amonetize
4.98

File size:
404.7 KB (414,416 bytes)

Product version:
1.1.8.22

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\kotonoha no hana cd__3038_i1320714092_il1583278.exe

Digital Signature
Signed by:
Ukra-2006 LLC

Authority:
Thawte, Inc.

Valid from:
6/30/2014 8:00:00 PM

Valid to:
7/1/2015 7:59:59 PM

Subject:
CN=Ukra-2006 LLC, O=Ukra-2006 LLC, L=Kharkiv, S=Harkivska obl, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2B3200D1AF3CAC4253C00F000EF4BAB9

File PE Metadata
Compilation timestamp:
9/10/2014 10:59:43 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:2a5Mqqub6lskGCEurlTA2xhDUyMniPUo6/MrlQi04U9rRrar4C028kCV2z2a:XMqp6ikqgRpxhiit6UurWF8V2zn

Entry address:
0x17610

Entry point:
E8, 8B, 84, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 94, AF, 3C, 00, 00, 75, 18, E8, A9, 7D, 00, 00, 6A, 1E, E8, F3, 7B, 00, 00, 68, FF, 00, 00, 00, E8, C3, F4, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 94, AF, 3C, 00, FF, 15, 60, 21, 3C, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 94, AF, 3C, 00, 00, 75, 18, E8, 5F, 7D, 00, 00, 6A, 1E, E8, A9, 7B, 00, 00, 68, FF, 00, 00, 00, E8, 79, F4, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Entropy:
7.2768

Code size:
192.5 KB (197,120 bytes)

The file kotonoha no hana cd__3038_i1320714092_il1583278.exe has been seen being distributed by the following 2 URLs.

http://www-squid.cluster11.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=bilan previsionnel sci gratuit_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1500000&ti2=0&ti3=DD1_2014-09-18T02:03:52.556332 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=bilan previsionnel sci gratuit&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1500000&ti2=0&ti3=DD1_2014-09-18T02:03:52.556332 00:00&parameter=bilan previsionnel sci gratuit&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1500000&ti2=0&ti3=DD1_2014-09-18T02:03:52.556332 00:00&parameter=bilan previsionnel sci gratuit&ti1=1500000&ti2=0&ti3=DD1_2014-09-18T02:03:52.556332 00:00

http://www-squid.cluster11.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=kotonoha no hana cd_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-09-18T03:56:45.343113 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=kotonoha no hana cd&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-09-18T03:56:45.343113 00:00&parameter=kotonoha no hana cd&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-09-18T03:56:45.343113 00:00&parameter=kotonoha no hana cd&ti1=1405000&ti2=0&ti3=DD1_2014-09-18T03:56:45.343113 00:00

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.