home

magiciso maker v54251 spanish__3039_i1081707458_il1646000.exe

Ukra-2006 LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application magiciso maker v54251 spanish__3039_i1081707458_il1646000.exe by Ukra-2006 has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Ukra-2006 LLC  (signed and verified)

Version:
1.1.8.22

MD5:
ac9d7f1d3c694a8d84b5b93a49c8474c

SHA-1:
8538a61606696fa2ca687a20a45139be522b4465

SHA-256:
a0a976f55d877a83ed6949956bdf652066ad6d8d2d94bf2a6be912e71ad0dee3

Scanner detections:
22 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/23/2024 10:20:09 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.Amonetize.N
926

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.07.24

Avira AntiVirus
APPL/Visucius.8
7.11.163.176

avast!
Win32:Amonetize-CL [PUP]
2014.9-140723

Bitdefender
Application.Bundler.Amonetize.N
1.0.20.1020

Dr.Web
Adware.Downware.5913
9.0.1.0204

ESET NOD32
Win32/Amonetize.BI (variant)
8.10144

Fortinet FortiGate
Adware/Amonetize
7/23/2014

F-Secure
Application.Bundler.Amonetize
11.2014-23-07_4

G Data
Application.Bundler.Amonetize
14.7.24

IKARUS anti.virus
not-a-virus:AdWare.Amonetize
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.181.12819

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.3515

Malwarebytes
PUP.Optional.Downloader
v2014.07.23.10

McAfee
RDN/Generic PUP.x!cjq
5600.7060

MicroWorld eScan
Application.Bundler.Amonetize.N
15.0.0.612

NANO AntiVirus
Riskware.Win32.Amonetize.dchxoa
0.28.2.60990

Panda Antivirus
Trj/CI.A
14.07.23.10

Reason Heuristics
PUP.Installer.Ukra2006.z
14.8.5.0

Sophos
Generic PUA IF
4.98

Trend Micro House Call
Suspicious_GEN.F47V0722
7.2.204

VIPRE Antivirus
Trojan.Win32.Generic
31540

File size:
343.7 KB (351,952 bytes)

Product version:
1.1.8.22

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\programs\magiciso maker v54251 spanish__3039_i1081707458_il1646000.exe

Digital Signature
Signed by:
Ukra-2006 LLC

Authority:
Thawte, Inc.

Valid from:
6/30/2014 9:00:00 PM

Valid to:
7/1/2015 8:59:59 PM

Subject:
CN=Ukra-2006 LLC, O=Ukra-2006 LLC, L=Kharkiv, S=Harkivska obl, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2B3200D1AF3CAC4253C00F000EF4BAB9

File PE Metadata
Compilation timestamp:
7/22/2014 2:05:57 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:gBieRGukt2xUBTBIULoqfaVST5qIYVyeCh476ulayEkdv+P3y9:CvsN2xUBT/JZTZ5f6z2Pi9

Entry address:
0x14C32

Entry point:
E8, E8, 5F, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 3C, 8E, 3F, 00, 00, 75, 18, E8, C8, 59, 00, 00, 6A, 1E, E8, 12, 58, 00, 00, 68, FF, 00, 00, 00, E8, 10, F6, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3, EB, 03, 33, C0, 40, 50, 6A, 00, FF, 35, 3C, 8E, 3F, 00, FF, 15...
 
[+]

Code size:
116.5 KB (119,296 bytes)

The file magiciso maker v54251 spanish__3039_i1081707458_il1646000.exe has been seen being distributed by the following 11 URLs.

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3516&instid[appname]=caperucita roja 2011_Downloader&instid[appsetupurl]=http://go.venturedownload.com/getfast/download.cgi?9&ti1=1460000&ti2=0&ti3=DD1_2014-07-24T00:13:02.672874+00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.venturedownload.com/d1/logo150x150.png&prefix=caperucita roja 2011&instid[thankyoupage]=http://download.venturedownload.com/.../thank_you.php?ti1=1460000&ti2=0&ti3=DD1_2014-07-24T00:13:02.672874+00:00&parameter=caperucita roja 2011&instid[interrupted]=http://download.venturedownload.com/.../interrupted.php?ti1=1460000&ti2=0&ti3=DD1_2014-07-24T00:13:02.672874+00:00&parameter=caperucita roja 2011&ti1=1460000&ti2=0&ti3=DD1_2014-07-24T00:13:02.672874 00:00

http://download.futuresdownload.com/.../get.php?q=dragones de berk latino cielo salvaje&ti1=700000&ti2=8&ti3=2014-07-23T19:13:27.723818 00:00

http://download.trustworthydownload.com/.../get.php?q=Schindler's List (1993) 720p HDTV X264 - 800MB - YIFY&ti1=800000&ti2=0&ti3=2014-07-23T16:00:29.495656 00:00

http://download.verticdn.com/.../get.php?q=The_Black_Market.rar&ti1=1585000&ti2=0&ti3=2014-07-22T19:49:24.547951 00:00

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=bilo rani_Downloader&instid[appsetupurl]=http://go.bragdownload.com/getfast/download.cgi?9&ti1=1930000&ti2=0&ti3=2014-07-22T14:44:40.971381 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.bragdownload.com/d1/logo150x150.png&prefix=bilo rani&instid[thankyoupage]=http://download.bragdownload.com/.../thank_you.php?ti1=1930000&ti2=0&ti3=2014-07-22T14:44:40.971381 00:00&parameter=bilo rani&instid[interrupted]=http://download.bragdownload.com/.../interrupted.php?ti1=1930000&ti2=0&ti3=2014-07-22T14:44:40.971381 00:00&parameter=bilo rani&ti1=1930000&ti2=0&ti3=2014-07-22T14:44:40.971381 00:00

http://download.bragdownload.com/.../get.php?q=bilo rani&ti1=1930000&ti2=0&ti3=2014-07-22T14:44:40.971381 00:00

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=ka pieradinat puki 2_Downloader&instid[appsetupurl]=http://go.futuresdownload.com/getfast/download.cgi?9&ti1=700000&ti2=4&ti3=2014-07-22T19:11:01.872741 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.futuresdownload.com/d1/logo150x150.png&prefix=ka pieradinat puki 2&instid[thankyoupage]=http://download.futuresdownload.com/.../thank_you.php?ti1=700000&ti2=4&ti3=2014-07-22T19:11:01.872741 00:00&parameter=ka pieradinat puki 2&instid[interrupted]=http://download.futuresdownload.com/.../interrupted.php?ti1=700000&ti2=4&ti3=2014-07-22T19:11:01.872741 00:00&parameter=ka pieradinat puki 2&ti1=700000&ti2=4

http://download.futuresdownload.com/.../get.php?q=ka pieradinat puki 2&ti1=700000&ti2=4&ti3=2014-07-22T19:11:01.872741 00:00

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=Database Systems The Complete Book 2nd Edition Solutions Manual Free_Downloader&instid[appsetupurl]=http://go.getitfastdownload.com/getfast/download.cgi?9&ti1=1240000&ti2=10&ti3=2014-07-22T09:19:26.699723 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getitfastdownload.com/d1/logo150x150.png&prefix=Database Systems The Complete Book 2nd Edition Solutions Manual Free&instid[thankyoupage]=http://download.getitfastdownload.com/.../thank_you.php?ti1=1240000&ti2=10&ti3=2014-07-22T09:19:26.699723 00:00&parameter=Database Systems The Complete Book 2nd Edition Solutions Manual Free&instid[interrupted]=http://download.getitfastdownload.com/.../interrupted.php?ti1=1240000&ti2=10&ti3=2014-07-22T09:19

http://www-squid.cluster10.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3515&instid[appname]=Database Systems The Complete Book 2nd Edition Solutions Manual Free_Downloader&instid[appsetupurl]=http://go.getitfastdownload.com/getfast/download.cgi?9&ti1=1240000&ti2=10&ti3=2014-07-22T09:19:26.699723 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.getitfastdownload.com/d1/logo150x150.png&prefix=Database Systems The Complete Book 2nd Edition Solutions Manual Free&instid[thankyoupage]=http://download.getitfastdownload.com/.../thank_you.php?ti1=1240000&ti2=10&ti3=2014-07-22T09:19:26.699723 00:00&parameter=Database Systems The Complete Book 2nd Edition Solutions Manual Free&instid[interrupted]=http://download.getitfastdownload.com/.../interrupted.php?ti1=1240000&ti2=10&ti3=2014-07-22T09:19

http://download.getitfastdownload.com/.../get.php?q=Database Systems The Complete Book 2nd Edition Solutions Manual Free&ti1=1240000&ti2=10&ti3=2014-07-22T09:19:26.699723 00:00

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-58-41.gru1.r.cloudfront.net  (54.230.58.41:80)

TCP (HTTP):
Connects to ec2-107-20-210-63.compute-1.amazonaws.com  (107.20.210.63:80)

TCP (HTTP):
Connects to ec2-107-20-147-93.compute-1.amazonaws.com  (107.20.147.93:80)

TCP (HTTP):
Connects to 67.215.238.66.static.quadranet.com  (67.215.238.66:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.