home

lanch_7882.exe

Setup

The application lanch_7882.exe has been detected as a potentially unwanted program by 22 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from d1ykyz0mbyn4to.cloudfront.net and multiple other hosts.
Product:
Setup

Version:
1.0.0.1

MD5:
d0b7537c1ce3805bd28e9cb9c8ca232c

SHA-1:
0ae7a19f4cf418263bd14b92d9603bdcd46ccb5f

SHA-256:
3eb035d8b6f6b544ed766a3d5015b3e57cfbecd7028ea53181e74b67c88a4ddd

Scanner detections:
22 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 11:38:54 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2620924
519

Agnitum Outpost
Trojan.DR.Agent
7.1.1

Avira AntiVirus
ADWARE/Amonetize.443904
8.3.1.6

Arcabit
Trojan.Generic.D27FDFC
1.0.0.425

avast!
Win32:Dropper-gen [Drp]
2014.9-150903

AVG
BundleApp
2016.0.2997

Baidu Antivirus
PUA.Win32.Amonetize
4.0.3.1593

Bitdefender
Trojan.GenericKD.2620924
1.0.20.1230

Dr.Web
Trojan.Amonetize.5207
9.0.1.0246

Emsisoft Anti-Malware
Trojan.GenericKD.2620924
8.15.09.03.04

ESET NOD32
Win32/Amonetize.GI potentially unwanted (variant)
9.12083

Fortinet FortiGate
Riskware/Amonetize
9/3/2015

F-Secure
Trojan.GenericKD.2620924
11.2015-03-09_5

G Data
Trojan.GenericKD.2620924
15.9.25

IKARUS anti.virus
not-a-virus:AdWare.Amonetize
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.208.16865

McAfee
RDN/Generic.dx
5600.6653

MicroWorld eScan
Trojan.GenericKD.2620924
16.0.0.738

nProtect
Trojan.GenericKD.2620924
15.08.12.01

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Trend Micro
TROJ_GEN.R01TC0EHB15
10.465.03

VIPRE Antivirus
Trojan.Win32.Generic
42816

File size:
433.5 KB (443,904 bytes)

Product version:
1.0.0.1

Copyright:
Copyright (C) 2015

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
Hebraico (Israel)

Common path:
C:\users\{user}\appdata\local\temp\lanch_7882.exe

File PE Metadata
Compilation timestamp:
8/2/2015 10:35:52 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:nFvYivhznWvFFzkgbe03zbslk7bPy8mq4NQKC/2+6Df6I:nFvtqvFtkV0kk3Py8nOn6

Entry address:
0x1303D

Entry point:
E8, 78, 8D, 00, 00, E9, 7F, FE, FF, FF, E8, AC, 72, 00, 00, 8B, D0, 8B, 42, 6C, 3B, 05, 7C, 68, 43, 00, 74, 10, 8B, 0D, 3C, 69, 43, 00, 85, 4A, 70, 75, 05, E8, 91, 70, 00, 00, 8B, 40, 04, C3, E8, 86, 72, 00, 00, 8B, D0, 8B, 42, 6C, 3B, 05, 7C, 68, 43, 00, 74, 10, 8B, 0D, 3C, 69, 43, 00, 85, 4A, 70, 75, 05, E8, 6B, 70, 00, 00, 05, A0, 00, 00, 00, C3, E8, 5E, 72, 00, 00, 8B, D0, 8B, 42, 6C, 3B, 05, 7C, 68, 43, 00, 74, 10, 8B, 0D, 3C, 69, 43, 00, 85, 4A, 70, 75, 05, E8, 43, 70, 00, 00, 8B, 40, 74, C3, 55, 8B...
 
[+]

Code size:
160.5 KB (164,352 bytes)

The file lanch_7882.exe has been seen being distributed by the following 7 URLs.

http://d1ykyz0mbyn4to.cloudfront.net/cl/inst/bundles/FasterInternet_Amonetize/.../downloadb.exe

http://d1ykyz0mbyn4to.cloudfront.net/cl/inst/bundles/AnySent_Amonetize/.../downloadb.exe

http://d1pg43ots40sgg.cloudfront.net/bundle/SuperClick_Amonetize/.../downloadb.exe

http://d3ijsb1ryk5jd8.cloudfront.net/cl/inst/bundles/YTDownloader_Amonetize/.../downloadb.exe

http://dmrm038s4vkzd.cloudfront.net/cl/inst/bundles/YTDownloader_Amonetize/.../downloadb.exe

http://dmrm038s4vkzd.cloudfront.net/cl/inst/bundles/CPU_Amonetize/.../downloadb.exe

http://d1ykyz0mbyn4to.cloudfront.net/cl/inst/bundles/HyperBrows_Amonetize/.../downloadb.exe

Remove lanch_7882.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.