» polski_fiat_126p_repair_manual_downloader.exe
Overview
Analysis
File Details
Downloads (1)

polski_fiat_126p_repair_manual_downloader.exe

YourFileDownloader Installer

Via Advertising Group Limited

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application polski_fiat_126p_repair_manual_downloader.exe by Via Advertising Group Limited has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dll513.worldfiledownload.biz.

File name:

Publisher:

http://yourfile-downloader.com (signed by Via Advertising Group Limited)

Product:

YourFileDownloader Installer

Version:

1, 0, 384, 1

MD5:

540b8c5ec6f2b3641c429853d2ce1a7e

SHA-1:

4eb0bc3964b053079920fffeeda2ad93259475f6

SHA-256:

6c94ad957603c353ea516e1ddd6f35a02a7735ec8e48803072a62f6098a4d80f

Scanner detections:

11 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/15/2024 4:04:11 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/Downloader.Gen4

7.11.188.58

avast!

Win32:Downloader-UEO [PUP]

141119-1

Dr.Web

Adware.Downware.10330

9.0.1.0160

Emsisoft Anti-Malware

Trojan.Generic.12232653

8.15.06.09.05

ESET NOD32

Win32/ExpressDownloader.K potentially unwanted application

7.0.302.0

F-Secure

Trojan.Generic.12232653

11.2015-09-06_3

Malwarebytes

PUP.Optional.Downloader

v2015.06.09.05

Norman

Trojan.Generic.12232653

11.20150609

Reason Heuristics

PUP.Installer.ViaAdvertisingGroupLimited.j

14.11.22.15

Sophos

PUA 'Go For Files'

5.15

VIPRE Antivirus

Threat.4758264

35010

File size:

3.7 MB (3,909,376 bytes)

Product version:

1.0.0.1

Original file name:

YourFileDownloaderInstaller.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

YourFile Downloader

Language:

English

Common path:

C:\users\{user}\downloads\polski_fiat_126p_repair_manual_downloader.exe

Digital Signature

Signed by:

Via Advertising Group Limited

Authority:

COMODO CA Limited

Valid from:

4/11/2013 8:00:00 PM

Valid to:

4/11/2016 7:59:59 PM

Subject:

CN=Via Advertising Group Limited, O=Via Advertising Group Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00BABC309174F531C6762BBA466401FEAF

File PE Metadata

Compilation timestamp:

11/20/2014 3:47:49 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

98304:CcOBGbuhblyYT6WiJQ8lTtEkpAOrj2hYq:xOAglyYT6WniNpAfhx

Entry address:

0x6C9FD8

Entry point:

E8, 76, A8, 00, 00, AE, BC, 2E, 09, 25, DA, CB, 7A, BD, EF, BB, EA, 71, 08, CE, 45, 2E, DD, A7, D5, 51, C5, 18, 8D, D6, 07, E3, 53, 6E, E5, C1, 96, 61, 37, C1, 06, 93, 7B, C4, 45, 72, E2, BA, 10, FE, ED, FD, A1, C5, 3E, E4, 75, D9, 84, 49, C7, BC, DC, E7, FF, 52, C0, C8, 58, E3, B6, 82, 63, 82, 58, BC, AE, AA, ED, 93, 32, 09, AE, 1E, 13, 0D, 26, 03, BB, 92, 19, 68, CF, 9A, F9, CC, CB, 08, A8, 9C, 61, FD, 70, E7, 55, F9, 9F, 4A, 90, 82, 91, E9, 89, 37, 90, B7, 5E, 80, F6, E4, A9, F8, A0, 14, DD, 45, 36, E1... 
[+]

Entropy:

7.9049 (probably packed)

Code size:

782.5 KB (801,280 bytes)

The file polski_fiat_126p_repair_manual_downloader.exe has been seen being distributed by the following URL.

http://dll513.worldfiledownload.biz/j5GVWG7DolIt8qRefpPgcTjM/hV3sLgiZO QLnS9gD84uJZqE TYbRPl3Ggc79cQW76cAw/ZwF8G09sfW5p1HVueWh4mzTpdMoZsGSyRctw6hWXibzE/6DptfuRnOQfnOn96/w1jXaYSfEj DmtfxhoyVsgfBk3PBXtewA9GNcEHERDkpEIs2uprLtPjWzqc4FNo97Q0PbjJLS3yr3hP4q10S Gafl/tgCEMgMI5AouTOUKGh1hK3dIFRY7YWrKXh13kz6NB7czyTO/I E6pYKpa4Gbvw9EtuuOgarSuwnKqsYgmxODbdILhzmu18dUe3LrHRpzEhBLHkJtbx8DnWJvV ABnhP4CY4X5CzyMsCE42rFydPnpfnCi5Xsq/.../6D

Remove polski_fiat_126p_repair_manual_downloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.