home

selma.2014.dvdscr.x264-playnow_downloader.exe

YourFileDownloader Installer

Ironnuts LLC

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application selma.2014.dvdscr.x264-playnow_downloader.exe by Ironnuts has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the YourFile Downloader installer. The file has been seen being downloaded from dj234.yourfiledl.com.
Publisher:
http://yourfile-downloader.com  (signed by Ironnuts LLC)

Product:
YourFileDownloader Installer

Version:
1, 0, 685, 1

MD5:
6f003129214d85e23986dfe7f5955b25

SHA-1:
6002bda79cf803f80d79a27d520f534ae410aa29

SHA-256:
ea78c6955ff713da946b3199aad4c0f828350cc0ec6282ac06a7b7f6ff195f68

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/29/2024 12:46:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Via Advertising.Ironnuts.Bundler (M)
16.7.9.9

File size:
4.5 MB (4,679,632 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\downloads\selma.2014.dvdscr.x264-playnow_downloader.exe

Digital Signature
Signed by:
Ironnuts LLC

Authority:
Ironnuts LLC

Valid from:
5/12/2015 4:13:26 PM

Valid to:
5/11/2016 4:13:26 PM

Subject:
CN=Ironnuts LLC, OU=Ironnuts LLC, O=Ironnuts LLC, S=London, C=UK

Issuer:
CN=Ironnuts LLC, C=UK, S=London, L=London, E=admin@ironnuts.com, OU=Ironnuts LLC, O=Ironnuts LLC

Serial number:
100001

File PE Metadata
Compilation timestamp:
5/5/2015 10:27:24 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:Rof/k+FPMLN+Wbul622pJuNanW68O7uKo0UiQPQbr6e3GRVdbvCy:RSkwPMLN+WbO3NyWo7uKo0UiQobrrgVh

Entry address:
0x8FC7A9

Entry point:
50, E8, 45, 17, 00, 00, A3, 20, 08, 0B, 33, 62, 42, B7, 42, A3, DA, 3B, 72, E7, D6, 89, 74, F8, E7, 8A, C1, 1E, 55, AA, 95, 45, 7C, FD, E8, 94, F8, AD, 98, 3C, DE, FE, 63, 1B, F3, D9, F4, 4B, 2F, B7, A2, 2A, C3, 03, EB, A0, 87, 02, AD, 39, AA, 7F, 8C, 50, 28, 81, B8, 09, 63, 6E, 06, C3, C8, 6C, 2F, 85, 9D, DD, 7A, 1E, E8, 3E, 5A, EE, 20, 87, 23, 36, 7E, E6, DD, 65, 95, 0A, 64, 88, A1, C4, 45, 78, 47, DA, 34, 92, C7, 50, CE, 4D, F1, 2C, 91, 6C, 37, AD, 20, C6, C2, E5, 3C, 53, E6, FF, 9C, 02, 35, 96, 6F, D5...
 
[+]

Entropy:
7.9280  (probably packed)

Code size:
1.1 MB (1,187,328 bytes)

The file selma.2014.dvdscr.x264-playnow_downloader.exe has been seen being distributed by the following URL.

http://dj234.yourfiledl.com/j5GWUm7dqBU0hPwLJPyHB13/h2lK8u9/O5SRDkOGrgQ4uJZqE TaahHl324e7dcQW76cAw/RyVsC0shYHJhgAUqCYAUdmW1GddJ5DSued oto2H ImUkuHBnceY5YxyieHhB5D14RugSKUz7R3ZU10B1W8EdBk3PBXtewA9GNcEHEQz5pEIs2uprLtPjWzqc4FNo97Q0PbjJLS3yqHpS/a97U/mRaUfpk2BLqssHGYLdNEjRgFVMjo9VSIveWrKSjl61w/ZIu8ryTbzGrkvyMf5K8SGn4aRNkKLxaOftzzW97dEq07baboT9yUCJ cUe37rFVZ3EzEiC 9RLx5rnQZ/CoQo6iPEPIMDwVyzTtDoz2u1xKvjofXCi7Cx8/.../zQNEexj2pDtYg6TL6TBhg=

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.