» launcher__3834_il22066.exe
Overview
Analysis
File Details
Downloads (40)
Network (1)

launcher__3834_il22066.exe

The application launcher__3834_il22066.exe has been detected as a potentially unwanted program by 18 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from download.getlinksinaseconds.com and multiple other hosts. While running, it connects to the Internet address server-54-230-157-104.sin3.r.cloudfront.net on port 80 using the HTTP protocol.

File name:

Version:

1.1.5.90

MD5:

ad1c27b3c61f35f65038a79262b89b12

SHA-1:

ced3ef8712645feb82886869a89b8e21a95e185a

SHA-256:

de97794979a3b9f740c79b46648f7ab907888b264f0633eb9fbd88be85395c86

Scanner detections:

18 / 68

Status:

Potentially unwanted

Analysis date:

11/23/2024 2:34:05 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.GenericKD.1622289

1044

AhnLab V3 Security

PUP/Win32.Amonetiz

14.03.28

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.139.230

Bitdefender

Trojan.GenericKD.1622289

1.0.20.435

Comodo Security

ApplicUnwnt

18007

Emsisoft Anti-Malware

Trojan.GenericKD.1622289

8.14.03.28.11

ESET NOD32

Win32/Amonetize.AJ (variant)

8.9608

Fortinet FortiGate

Riskware/Amonetize

3/28/2014

G Data

Trojan.GenericKD.1622289

14.3.24

Kaspersky

not-a-virus:HEUR:AdWare.Win32.Amonetize

14.0.0.4103

Malwarebytes

PUP.Optional.Amonetize.A

v2014.03.28.11

McAfee

Artemis!AD1C27B3C61F

5600.7178

MicroWorld eScan

Trojan.GenericKD.1622289

15.0.0.261

Qihoo 360 Security

Win32/Virus.Adware.932

1.0.0.1015

Reason Heuristics

Threat.Win.Reputation.IMP

14.3.31.15

Sophos

Amonetize

4.98

Trend Micro House Call

TROJ_GEN.F47V0327

7.2.87

VIPRE Antivirus

Amonetize

27798

File size:

331.5 KB (339,456 bytes)

Product version:

1.1.5.90

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\launcher__3834_il22066.exe

File PE Metadata

Compilation timestamp:

3/27/2014 9:16:27 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:oNEbWTaJmUL+Dvzy+bBxA3IBCTeR2hMNb/ksRoAfQBqlss4I3/sBHO:oNEbWEmUa7zy+lxAnXsksaAfQBgssGBu

Entry address:

0x28131

Entry point:

E8, D0, 97, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F... 
[+]

Entropy:

6.4345

Code size:

236.5 KB (242,176 bytes)

The file launcher__3834_il22066.exe has been seen being distributed by the following 40 URLs.

http://download.getlinksinaseconds.com/.../get.php?q=PC: Crash Bandicoot 3&ti1=1075000&ti2=0&ti3=2014-03-30T03:52:08.302382 00:00

http://download.getlinksinaseconds.com/.../get.php?q=Son of God (2014) DVD-R6&ti1=1365000&ti2=0&ti3=2014-03-29T00:52:57.102121 00:00&__cookie=guard=1

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3038&instid[appname]=Air Elicenser Emulator_Downloader&instid[appsetupurl]=http://go.trustworthydownload.com/getfast/download.cgi?9&ti1=1145000&ti2=0&ti3=2014-03-29T20:27:07.536462 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.trustworthydownload.com/d1/logo150x150.png&prefix=Air Elicenser Emulator&instid[thankyoupage]=http://download.trustworthydownload.com/.../thank_you.php?ti1=1145000&ti2=0&ti3=2014-03-29T20:27:07.536462 00:00&parameter=Air Elicenser Emulator&instid[interrupted]=http://download.trustworthydownload.com/.../interrupted.php?ti1=1145000&ti2=0&ti3=2014-03-29T20:27:07.536462 00:00&parameter=Air Elicenser Emulator&ti1=1145000&ti2=0&ti3=2014-03-29T20:27:07.536462 00:00

http://download.trustworthydownload.com/.../get.php?q=Air Elicenser Emulator&ti1=1145000&ti2=0&ti3=2014-03-29T20:27:07.536462 00:00

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=4893&instid[appname]=WinRar&instid[appsetupurl]=http://.../wrar501.exe&instid[cmdline]=&instid[appimageurl]=http://kingdls.com/g/winrar150.png&prefix=Winrar&instid[thankyoupage]=http://.../dl.php?thank-you

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3038&instid[appname]=Presenter Radio Automation_Downloader&instid[appsetupurl]=http://go.trustworthydownload.com/getfast/download.cgi?9&ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.trustworthydownload.com/d1/logo150x150.png&prefix=Presenter Radio Automation&instid[thankyoupage]=http://download.trustworthydownload.com/.../thank_you.php?ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&parameter=Presenter Radio Automation&instid[interrupted]=http://download.trustworthydownload.com/.../interrupted.php?ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&parameter=Presenter Radio Automation&ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3515&instid[appname]=Presenter Radio Automation_Downloader&instid[appsetupurl]=http://go.trustworthydownload.com/getfast/download.cgi?9&ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.trustworthydownload.com/d1/logo150x150.png&prefix=Presenter Radio Automation&instid[thankyoupage]=http://download.trustworthydownload.com/.../thank_you.php?ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&parameter=Presenter Radio Automation&instid[interrupted]=http://download.trustworthydownload.com/.../interrupted.php?ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00&parameter=Presenter Radio Automation&ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00

http://download.trustworthydownload.com/.../get.php?q=Presenter Radio Automation&ti1=1145000&ti2=0&ti3=2014-03-28T20:36:50.839962 00:00

http://v4download.com/b/download.php?id=Eseck&title=Call of Duty Ghosts Keygen&url=http://.../download.php?title=keyword_request&id=Eseck

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3039&instid[appname]=Pokemon Battle Revolution Rom Wii.rar_Downloader&instid[appsetupurl]=http://go.venturedownload.com/getfast/download.cgi?9&ti1=1500000&ti2=0&ti3=2014-03-29T10:40:13.526090 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.venturedownload.com/d1/logo150x150.png&prefix=Pokemon Battle Revolution Rom Wii.rar&instid[thankyoupage]=http://download.venturedownload.com/.../thank_you.php?ti1=1500000&ti2=0&ti3=2014-03-29T10:40:13.526090 00:00&parameter=Pokemon Battle Revolution Rom Wii.rar&instid[interrupted]=http://download.venturedownload.com/.../interrupted.php?ti1=1500000&ti2=0&ti3=2014-03-29T10:40:13.526090 00:00&parameter=Pokemon Battle Revolution Rom Wii.rar&ti1=1500000&ti2=0&ti3=2014-03-29T10:4

http://download.venturedownload.com/.../get.php?q=Pokemon_Battle_Revolution_Rom_Wii.rar&ti1=1500000&ti2=0&ti3=2014-03-29T10:40:13.526090 00:00

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3038&instid[appname]=backtrack 5 windows 7 crack torrent_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=900000&ti2=1&ti3=2014-03-28T20:31:05.215173 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=backtrack 5 windows 7 crack torrent&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=900000&ti2=1&ti3=2014-03-28T20:31:05.215173 00:00&parameter=backtrack 5 windows 7 crack torrent&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=900000&ti2=1&ti3=2014-03-28T20:31:05.215173 00:00&parameter=backtrack 5 windows 7 crack torrent&ti1=900000&ti2=1&ti3=2014-03-28T20:31:05.215173 00:00

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=6857&instid[appname]=Xjz survey remover&instid[appsetupurl]=http://www.idlprovider.com/.../download3.exe

http://v4download.com/.../download.php?id=iok1988&title=Xjz survey remover&url=www.gamestrick.org

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3038&instid[appname]=Th e Ms of Ld Ian Manzie (3817).rar_Downloader&instid[appsetupurl]=http://go.verticdn.com/getfast/download.cgi?9&ti1=1585000&ti2=0&ti3=2014-03-29T13:15:56.770125 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.verticdn.com/d1/logo150x150.png&prefix=Th e Ms of Ld Ian Manzie (3817).rar&instid[thankyoupage]=http://download.verticdn.com/.../thank_you.php?ti1=1585000&ti2=0&ti3=2014-03-29T13:15:56.770125 00:00&parameter=Th e Ms of Ld Ian Manzie (3817).rar&instid[interrupted]=http://download.verticdn.com/.../interrupted.php?ti1=1585000&ti2=0&ti3=2014-03-29T13:15:56.770125 00:00&parameter=Th e Ms of Ld Ian Manzie (3817).rar&ti1=1585000&ti2=0&ti3=2014-03-29T13:1

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3516&instid[appname]=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=500000&ti2=1&ti3=2014-03-30T01:26:37.061698 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=500000&ti2=1&ti3=2014-03-30T01:26:37.061698 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=500000&ti2=1&ti3=2014-03-30T01:26:37.061698 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTA

http://download.getlinksinaseconds.com/.../get.php?q=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&ti1=500000&ti2=1&ti3=2014-03-30T01:26:37.061698 00:00

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3038&instid[appname]=300 Rise Of An Empire HC Webrip x264 AC3 TiTAN.mkv_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=500000&ti2=1&ti3=2014-03-30T00:58:07.243808 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=300 Rise Of An Empire HC Webrip x264 AC3 TiTAN.mkv&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=500000&ti2=1&ti3=2014-03-30T00:58:07.243808 00:00&parameter=300 Rise Of An Empire HC Webrip x264 AC3 TiTAN.mkv&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=500000&ti2=1&ti3=2014-03-30T00:58:07.243808 00:00&parameter=300 Rise Of An Empi

http://download.getlinksinaseconds.com/.../get.php?q=300 Rise Of An Empire HC Webrip x264 AC3 TiTAN.mkv&ti1=500000&ti2=1&ti3=2014-03-30T00:58:07.243808 00:00

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3515&instid[appname]=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=500000&ti2=1&ti3=2014-03-30T00:55:03.120227 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=500000&ti2=1&ti3=2014-03-30T00:55:03.120227 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=500000&ti2=1&ti3=2014-03-30T00:55:03.120227 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTA

http://download.getlinksinaseconds.com/.../get.php?q=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&ti1=500000&ti2=1&ti3=2014-03-30T00:55:03.120227 00:00

http://dds10.fb-hosting-apps.com/download.php?version=1.1.5.90&campid=3515&instid[appname]=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv_Downloader&instid[appsetupurl]=http://go.getlinksinaseconds.com/getfast/download.cgi?9&ti1=500000&ti2=1&ti3=2014-03-30T00:51:06.788687 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getlinksinaseconds.com/d1/logo150x150.png&prefix=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[thankyoupage]=http://download.getlinksinaseconds.com/.../thank_you.php?ti1=500000&ti2=1&ti3=2014-03-30T00:51:06.788687 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&instid[interrupted]=http://download.getlinksinaseconds.com/.../interrupted.php?ti1=500000&ti2=1&ti3=2014-03-30T00:51:06.788687 00:00&parameter=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTA

http://download.getlinksinaseconds.com/.../get.php?q=300.Rise.Of.An.Empire.HC.Webrip.x264.AC3.TiTAN.mkv&ti1=500000&ti2=1&ti3=2014-03-30T00:51:06.788687 00:00

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=4000&instid[appname]=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[appsetupurl]=http://19.get.getmdownloader.com/files/MD_setup_1.0.16.exe&instid[cmdline]=/verysilent&instid[appimageurl]=http://.../static/md/images/logo_150.png&prefix=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[thankyoupage]=http://.../upgrade&ti1=w200s303i923p15e9c0&ti2=IZoyrk8kxbbfb5YaRCORyXOY1kAaBYUkcAs4ldcmGqJh0OB4gUBl5rKtbtftPEkou_naiFkwYuWZVSzJW5y5Upw

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=3865&instid[appname]=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[appsetupurl]=http://16.get.getmdownloader.com/files/MD_setup_1.0.16.exe&instid[cmdline]=/verysilent&instid[appimageurl]=http://.../static/md/images/logo_150.png&prefix=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[thankyoupage]=http://.../upgrade&ti1=w200s303i923p17e9c0&ti2=IZoyrk8kxbbfb5YaRCORyXOY1kAaBYUkcAs4ldcmGqJh0OB4gUBl5rKtbtftPEkou_naiFkwYuWZVSzJW5y5Upw

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=5547&instid[appname]=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[appsetupurl]=http://16.get.getmdownloader.com/files/MD_setup_1.0.16.exe&instid[cmdline]=/verysilent&instid[appimageurl]=http://.../static/md/images/logo_150.png&prefix=lenny.kravitz.26.traci.lords...american.woman.xxx.uncensored.5Bneptune5D.mp4&instid[thankyoupage]=http://.../upgrade&ti1=w200s303i923p16e9c0&ti2=IZoyrk8kxbbfb5YaRCORyXOY1kAaBYUkcAs4ldcmGqJh0OB4gUBl5rKtbtftPEkou_naiFkwYuWZVSzJW5y5Upw

http://getmdownloader.com/download/lenny.kravitz.&.traci.lords.-.american.woman.xxx.uncensored-[neptune].mp4.html?id=&na=IcNyC4rB7BGNNBJsXFIBf3Euy8KAimxAqQEUzJG69xL5paEON/Rc/Hn/.../8ejnhOvpCEWkgjD2lXYJr1yhtPKGwG5OH1Zw==&k=ITIbs3FrEtDfuclim4PE3W36uA_FW0TXztBHQT7IeaKgi2Qjnn9pY5cL9qI64MdAiv-qjg1oJUrtZC1YEgu10rI

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=5547&instid[appname]=CLASSIC.XXX...Traci.Lords...Traci2C.I.Love.You.40French41...FULL.L&instid[appsetupurl]=http://19.get.getmdownloader.com/files/MD_setup_1.0.16.exe&instid[cmdline]=/verysilent&instid[appimageurl]=http://.../static/md/images/logo_150.png&prefix=CLASSIC.XXX...Traci.Lords...Traci2C.I.Love.You.40French41...FULL.L&instid[thankyoupage]=http://.../upgrade&ti1=w200s303i923p16e9c0&ti2=IcLISBl_XfCcLXZ1efgx10JeH__0x1wVTtJ9NXt1S21H4j2TD1Cv4tmzJTsWYXP6Y2KwXxaj9KdpndbXIjKK-5Y

http://www.singulardownload.com/download.php?version=1.1.5.90&campid=4000&instid[appname]=CLASSIC.XXX...Traci.Lords...Traci2C.I.Love.You.40French41...FULL.L&instid[appsetupurl]=http://19.get.getmdownloader.com/files/MD_setup_1.0.16.exe&instid[cmdline]=/verysilent&instid[appimageurl]=http://.../static/md/images/logo_150.png&prefix=CLASSIC.XXX...Traci.Lords...Traci2C.I.Love.You.40French41...FULL.L&instid[thankyoupage]=http://.../upgrade&ti1=w200s303i923p15e9c0&ti2=IcLISBl_XfCcLXZ1efgx10JeH__0x1wVTtJ9NXt1S21H4j2TD1Cv4tmzJTsWYXP6Y2KwXxaj9KdpndbXIjKK-5Y

Latest 30 of 40 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to server-54-230-157-104.sin3.r.cloudfront.net (54.230.157.104:80)

Remove launcher__3834_il22066.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.