home

sales lead form template__3038_i1352633422_il1227804.exe

The application sales lead form template__3038_i1352633422_il1227804.exe has been detected as a potentially unwanted program by 29 anti-malware scanners. This is a setup program which is used to install the application. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from www-squid.cluster11.fb-hosting-apps.com and multiple other hosts.
Version:
1.1.8.22

MD5:
43c990e87e422fd2d32466a49195d350

SHA-1:
1401fcc766d55c961357d770ffd239865e0d2f44

SHA-256:
8ea40b838bc0d85b9ced69bb4e02e5ce1dfadd389b2041942141f21606ff4f0c

Scanner detections:
29 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 2:46:18 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11890872
772

AegisLab AV Signature
Troj.W32.Gen
2.1.4+

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.10.20

Avira AntiVirus
ADWARE/Adware.Gen4
7.11.179.140

avast!
Win32:Amonetize-EP [PUP]
2014.9-141225

AVG
Downloader.Generic14
2015.0.3250

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141225

Bitdefender
Trojan.Generic.11890872
1.0.20.1795

Dr.Web
Adware.Downware.8655
9.0.1.0359

Emsisoft Anti-Malware
Trojan.Generic.11890872
8.14.12.25.04

ESET NOD32
Win32/Amonetize.BS (variant)
8.10586

Fortinet FortiGate
Riskware/Amonetize
12/25/2014

F-Prot
W32/A-2cc77b1b
v6.4.7.1.166

F-Secure
Trojan.Generic.11890872
11.2014-25-12_5

G Data
Trojan.Generic.11890872
14.12.24

IKARUS anti.virus
not-a-virus:AdWare.Amonetize
t3scan.1.7.8.0

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.2744

Malwarebytes
PUP.Optional.Amonetize
v2014.12.25.04

McAfee
PUP-FQT
5600.6906

MicroWorld eScan
Trojan.Generic.11890872
15.0.0.1077

NANO AntiVirus
Riskware.Win32.Downware.dgawrg
0.28.2.62671

nProtect
Trojan.Generic.11890872
14.10.19.01

Reason Heuristics
Threat.Win.Reputation.IMP
14.12.25.4

Sophos
Generic PUA BE
4.98

Trend Micro House Call
TROJ_GEN.R02KC0EJ814
7.2.359

Trend Micro
TROJ_GEN.R02KC0EJ814
10.465.25

Vba32 AntiVirus
AdWare.Amonetize
3.12.26.3

Zillya! Antivirus
Adware.Amonetize.Win32.1328
2.0.0.1959

File size:
396.5 KB (406,016 bytes)

Product version:
1.1.8.22

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\sales lead form template__3038_i1352633422_il1227804.exe

File PE Metadata
Compilation timestamp:
9/25/2014 9:11:46 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:E7DOnRNXq77GRBmyDQdg8qG1CUCGS9qpoU3hCsrvJu4Z/Vqg4921ZYemyw2:bNXiaBrDK5qG14w3htDZ/kSv42

Entry address:
0x16CE0

Entry point:
E8, 7B, 84, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 44, 9F, 3C, 00, 00, 75, 18, E8, 94, 7D, 00, 00, 6A, 1E, E8, DE, 7B, 00, 00, 68, FF, 00, 00, 00, E8, C3, F4, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 44, 9F, 3C, 00, FF, 15, 58, 11, 3C, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 44, 9F, 3C, 00, 00, 75, 18, E8, 4A, 7D, 00, 00, 6A, 1E, E8, 94, 7B, 00, 00, 68, FF, 00, 00, 00, E8, 79, F4, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Code size:
190 KB (194,560 bytes)

The file sales lead form template__3038_i1352633422_il1227804.exe has been seen being distributed by the following 2 URLs.

http://www-squid.cluster11.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3516&instid[appname]=avocat gratuit mairie aulnay sous bois_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1500000&ti2=0&ti3=DD1_2014-10-02T13:44:59.505429 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=avocat gratuit mairie aulnay sous bois&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-02T13:44:59.505429 00:00&parameter=avocat gratuit mairie aulnay sous bois&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-02T13:44:59.505429 00:00&parameter=avocat gratuit mairie aulnay sous bois&ti1=1500000&ti2=0&ti3=DD1_2014-10-02T13:44:59.505429 00:00

http://www-squid.cluster11.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=sales lead form template_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1500000&ti2=0&ti3=DD1_2014-10-02T15:22:39.195173 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=sales lead form template&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-02T15:22:39.195173 00:00&parameter=sales lead form template&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-02T15:22:39.195173 00:00&parameter=sales lead form template&ti1=1500000&ti2=0&ti3=DD1_2014-10-02T15:22:39.195173 00:00

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.