home

miracle_of_petrochemicals-_olefins_industry-_an_in-depth_look_at_steam-crackers_downloader.exe

YourFileDownloader Installer

Ironnuts LLC

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application miracle_of_petrochemicals-_olefins_industry-_an_in-depth_look_at_steam-crackers_downloader.exe by Ironnuts has been detected as a potentially unwanted program by 19 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dll513.yourfaild.net.
Publisher:
http://yourfile-downloader.com  (signed by Ironnuts LLC)

Product:
YourFileDownloader Installer

Version:
1, 0, 685, 1

MD5:
5ff80c478de7152a33534fad4a197019

SHA-1:
0b18faedba737b1871b2d9b68941b1bfbab07f27

SHA-256:
2ee49251f06563d0213162af9d9316549fe806242fa673107ed913791b58f43c

Scanner detections:
19 / 68

Status:
Potentially unwanted

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/25/2024 12:30:09 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.14525543
5519494

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.YourFileDownloader
2015.05.18

Avira AntiVirus
PUA/EDownloader.Gen
8.3.1.6

avast!
Win32:Dropper-gen [Drp]
150414-0

AVG
Adware BundleApp_r.AX
2014.0.4311

Bitdefender
Trojan.Generic.14525543
1.0.20.690

Bkav FE
HW32.Packed
1.3.0.6379

Comodo Security
Virus.Win32.Virut.CE
22158

Emsisoft Anti-Malware
Trojan.Generic.14525543
10.0.0.5366

ESET NOD32
Win32/ExpressDownloader.N potentially unwanted application
7.0.302.0

F-Secure
Trojan.Generic.14525543
5.13.68

G Data
Trojan.Generic.14525543
15.5.25

K7 AntiVirus
Adware
13.204.15935

Malwarebytes
PUP.Optional.Downloader
v2015.05.18.04

MicroWorld eScan
Trojan.Generic.14525543
16.0.0.414

nProtect
Trojan.Generic.14525543
15.05.15.01

Reason Heuristics
Threat.Bundler.Via Advertising
15.5.18.0

VIPRE Antivirus
Threat.4150696
39676

File size:
4.5 MB (4,679,632 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\miracle_of_petrochemicals-_olefins_industry-_an_in-depth_look_at_steam-crackers_downloader.exe

Digital Signature
Signed by:
Ironnuts LLC

Authority:
Ironnuts LLC

Valid from:
5/12/2015 5:43:26 PM

Valid to:
5/11/2016 5:43:26 PM

Subject:
CN=Ironnuts LLC, OU=Ironnuts LLC, O=Ironnuts LLC, S=London, C=UK

Issuer:
CN=Ironnuts LLC, C=UK, S=London, L=London, E=admin@ironnuts.com, OU=Ironnuts LLC, O=Ironnuts LLC

Serial number:
100001

File PE Metadata
Compilation timestamp:
5/5/2015 11:57:24 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:Rof/k+FPMLN+Wbul622pJuNanW68O7uKo0UiQPQbr6e3GRVdbvCU:RSkwPMLN+WbO3NyWo7uKo0UiQobrrgVj

Entry address:
0x8FC7A9

Entry point:
50, E8, 45, 17, 00, 00, A3, 20, 08, 0B, 33, 62, 42, B7, 42, A3, DA, 3B, 72, E7, D6, 89, 74, F8, E7, 8A, C1, 1E, 55, AA, 95, 45, 7C, FD, E8, 94, F8, AD, 98, 3C, DE, FE, 63, 1B, F3, D9, F4, 4B, 2F, B7, A2, 2A, C3, 03, EB, A0, 87, 02, AD, 39, AA, 7F, 8C, 50, 28, 81, B8, 09, 63, 6E, 06, C3, C8, 6C, 2F, 85, 9D, DD, 7A, 1E, E8, 3E, 5A, EE, 20, 87, 23, 36, 7E, E6, DD, 65, 95, 0A, 64, 88, A1, C4, 45, 78, 47, DA, 34, 92, C7, 50, CE, 4D, F1, 2C, 91, 6C, 37, AD, 20, C6, C2, E5, 3C, 53, E6, FF, 9C, 02, 35, 96, 6F, D5...
 
[+]

Entropy:
7.9280  (probably packed)

Code size:
1.1 MB (1,187,328 bytes)

The file miracle_of_petrochemicals-_olefins_industry-_an_in-depth_look_at_steam-crackers_downloader.exe has been seen being distributed by the following URL.

http://dll513.yourfaild.net/j5GIXnDRqldjn6JZIei0N3zTti93rbAod6iuaimJyhxyqYM TKPCEkiwmCxeqohGHZ3eJlzLsAUboJgfToAqP1GDblwjhCIoMpFsEme7Y Itl3D1ISZt Gs1KbxrPRmhbDkSsRFlS/ICKRyvWiwAl106RcYAVFfOBHtUy0cbZ8cMTSPR61MWz/9EKIKyHjKv518 qNmLa/lGzWg6Txcp/YpBLPRPgyviDcCsowsFZDxPxqS3BQLkoswNcnIDeCf4Q/pnqEb1pWpSb3ZvhziXKcMqDXisrc/4qquN/S6kiD4 cRIivHac9uny3zc oVG26qGHsGRjU/Hl4RMz8z3AcrJ/.../mSfmKJ4lv2c4KbM0NCq5a2pCoW5tEaYAJB6vVQ==

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.