» setup__2738_il4190458.exe
Overview
Analysis
File Details
Downloads (54)
Network (2)

setup__2738_il4190458.exe

Installer

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup__2738_il4190458.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.

File name:

Publisher:

Amonetizé Ltd (signed by Shetef Solutions & Consulting (1998) Ltd.)

Product:

Installer

Version:

1.1.5.98

MD5:

45fb18cf50386bed09dc9b913310103d

SHA-1:

62989f54a28c08fa54319ec3704d33d7f08a8bc9

SHA-256:

332d476b69478ed05bde9e4ee987e990136be171892ea85b277b35ea8b2e4cd5

Scanner detections:

7 / 68

Status:

Adware

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

12/24/2024 3:49:02 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.123.168

Bkav FE

W32.Clodbbc.Trojan

1.3.0.4613

Dr.Web

Adware.Downware.1575

9.0.1.0359

ESET NOD32

Win32/Amonetize (variant)

7.9254

Malwarebytes

PUP.Optional.Amonetize

v2013.12.25.02

Reason Heuristics

PUP.Installer.ShetefSolutionsConsulting1998.V

14.8.8.3

Trend Micro House Call

TROJ_GEN.F47V1011

7.2.359

File size:

187.1 KB (191,616 bytes)

Product version:

2.1.12

Original file name:

Installer.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Common path:

C:\users\{user}\appdata\local\temp\setup__2738_il4190458.exe

Digital Signature

Signed by:

Shetef Solutions & Consulting (1998) Ltd.

Authority:

Thawte, Inc.

Valid from:

7/23/2013 3:00:00 AM

Valid to:

7/24/2014 2:59:59 AM

Subject:

CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7C23DBB97FAFBB9D28D413F836202024

File PE Metadata

Compilation timestamp:

10/11/2013 11:42:23 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:D0pC7FP2j91orwTBMVpA/8V3efAUfZVh8R/SAnktDzuCVdpSsfaCdBUXd:D6pjvR4i8s572sdpS8T2d

Entry address:

0x76100

Entry point:

60, BE, 00, D0, 44, 00, 8D, BE, 00, 40, FB, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.8205 (probably packed)

Code size:

168 KB (172,032 bytes)

The file setup__2738_il4190458.exe has been seen being distributed by the following 50 URLs.

http://download.aminst.net/.../get.php?q=CBGB2013HDRipx264AC3UNiQUE.mkv.flv&ti1=500000&ti2=0&ti3=2013-10-15T01:01:23.416348 00:00&__cookie=__atuvc=1|42; guard=1

http://download.aminst.net/.../get.php?q=Young.Detective.Dee.Rise.of.the.Sea.2013.DVDSCR.x264.AAC-JYK.flv.flv&ti1=500000&ti2=0&ti3=2013-10-13T00:25:13.520935 00:00

http://download.aminst.net/.../get.php?q=Clinical Respiratory Medicine, Third Edition&source=500&campaign=2789&ti3=

http://download.aminst.net/.../get.php?q=nadine jansen and nikita lactating&ti1=700000&ti2=0&ti3=2013-10-12T09:43:27.266418 00:00

http://mirrorfile.net/.../get.php?q=BigBangTheory_Season7_Episode3_mp4.flv

http://download.aminst.net/.../get.php?q=The_Purge.flv.flv&ti1=500000&ti2=0&ti3=2013-10-12T03:03:05.437470 00:00&__cookie=__atuvc=1|41

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=Breaking.Bad.ENG.S02x03.Bit.By.A.Dead.Bee.fuN.avi.flv_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Breaking.Bad.ENG.S02x03.Bit.By.A.Dead.Bee.fuN.avi.flv&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-13T21:54:43.980835 00:00&parameter=Breaking.Bad.ENG.S02x03.Bit.By.A.Dead.Bee.fuN.avi.flv&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-13T21:54:43.980835 00:00&parameter=Breaking.Bad.ENG.S02x03.Bit.By.A.Dead.Bee.fuN.avi.flv&ti1=500000&ti2=0&ti3=2013-10-13T21:54:43.980835 00:00

http://download.aminst.net/.../get.php?q=Breaking.Bad.ENG.S02x03.Bit.By.A.Dead.Bee.fuN.avi.flv&ti1=500000&ti2=0&ti3=2013-10-13T21:54:43.980835 00:00&__cookie=__atuvc=1|42

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=girl.code.104.hdtv.x264 sys.mp4.flv_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=girl.code.104.hdtv.x264 sys.mp4.flv&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-16T23:59:11.902199 00:00&parameter=girl.code.104.hdtv.x264 sys.mp4.flv&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-16T23:59:11.902199 00:00&parameter=girl.code.104.hdtv.x264 sys.mp4.flv&ti1=500000&ti2=0&ti3=2013-10-16T23:59:11.902199 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3039&instid[appname]= asdasdas.flv.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix= asdasdas.flv.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-16T17:39:38.920393 00:00&parameter= asdasdas.flv.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-16T17:39:38.920393 00:00&parameter= asdasdas.flv.mp4&ti1=500000&ti2=0&ti3=2013-10-16T17:39:38.920393 00:00

http://download.aminst.net/.../get.php?q=_asdasdas.flv.mp4&ti1=500000&ti2=0&ti3=2013-10-16T17:39:38.920393 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3515&instid[appname]=Pitch Perfect 2012 Brrip.mkv.mp4.flv_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Pitch Perfect 2012 Brrip.mkv.mp4.flv&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-15T00:31:58.876058 00:00&parameter=Pitch Perfect 2012 Brrip.mkv.mp4.flv&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-15T00:31:58.876058 00:00&parameter=Pitch Perfect 2012 Brrip.mkv.mp4.flv&ti1=500000&ti2=0&ti3=2013-10-15T00:31:58.876058 00:00

http://download.aminst.net/.../get.php?q=Pitch_Perfect_2012_Brrip.mkv.mp4.flv&ti1=500000&ti2=0&ti3=2013-10-15T00:31:58.876058 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3039&instid[appname]=InsidiousChapter22013CAMX264 PLAYNOW.mkv_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=InsidiousChapter22013CAMX264 PLAYNOW.mkv&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-12T06:32:31.162081 00:00&parameter=InsidiousChapter22013CAMX264 PLAYNOW.mkv&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-12T06:32:31.162081 00:00&parameter=InsidiousChapter22013CAMX264 PLAYNOW.mkv&ti1=500000&ti2=0&ti3=2013-10-12T06:32:31.162081 00:00

http://download.aminst.net/.../get.php?q=InsidiousChapter22013CAMX264-PLAYNOW.mkv&ti1=500000&ti2=0&ti3=2013-10-12T06:32:31.162081 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=2789&instid[appname]=Alcamo's Fundamentals of Microbiology, Ninth Edition_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Alcamo's Fundamentals of Microbiology, Ninth Edition&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500&ti2=2013-10-15T17:30:46 00:00&ti3=&parameter=Alcamo's Fundamentals of Microbiology, Ninth Edition&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500&ti2=2013-10-15T17:30:46 00:00&ti3=&parameter=Alcamo's Fundamentals of Microbiology, Ninth Edition&ti1=500&ti2=2013-10-15T17:30:46 00:00&ti3=

http://download.aminst.net/.../get.php?q=Alcamo's Fundamentals of Microbiology, Ninth Edition&source=500&campaign=2789&ti3=

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=LISZTOMANIA 1975 5B7YwOS55WuZo 5D 5Bf18 5D.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=LISZTOMANIA 1975 5B7YwOS55WuZo 5D 5Bf18 5D.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-17T02:58:26.297022 00:00&parameter=LISZTOMANIA 1975 5B7YwOS55WuZo 5D 5Bf18 5D.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-17T02:58:26.297022 00:00&parameter=LISZTOMANIA 1975 5B7YwOS55WuZo 5D 5Bf18 5D.mp4&ti1=500000&ti2=0&ti3=2013-10-17T02:58:26.297022 00:00

http://download.aminst.net/.../get.php?q=LISZTOMANIA__1975_-_5B7YwOS55WuZo_5D_5Bf18_5D.mp4&ti1=500000&ti2=0&ti3=2013-10-17T02:58:26.297022 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3515&instid[appname]=Pokemon.The.First.Movie.1999.DVDRip.XviD Pokemon.avi.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Pokemon.The.First.Movie.1999.DVDRip.XviD Pokemon.avi.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-17T16:42:46.296880 00:00&parameter=Pokemon.The.First.Movie.1999.DVDRip.XviD Pokemon.avi.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-17T16:42:46.296880 00:00&parameter=Pokemon.The.First.Movie.1999.DVDRip.XviD Pokemon.avi.mp4&ti1=500000&ti2=0&ti3=2013-10-17T16:42:46.296880 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=Ice Age 2006 The Meltdown.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Ice Age 2006 The Meltdown.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&parameter=Ice Age 2006 The Meltdown.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&parameter=Ice Age 2006 The Meltdown.mp4&ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00

http://download.aminst.net/.../get.php?q=Ice_Age_2006_The_Meltdown.mp4&ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&__cookie=__atuvc=1|41&__cookie=__atuvc=1|41

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3516&instid[appname]=Ice Age 2006 The Meltdown.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Ice Age 2006 The Meltdown.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&parameter=Ice Age 2006 The Meltdown.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&parameter=Ice Age 2006 The Meltdown.mp4&ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00

http://download.aminst.net/.../get.php?q=Ice_Age_2006_The_Meltdown.mp4&ti1=500000&ti2=0&ti3=2013-10-12T21:47:14.677466 00:00&__cookie=__atuvc=1|41

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3039&instid[appname]=descargar pack de musica salsa romantica_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=descargar pack de musica salsa romantica&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00&parameter=descargar pack de musica salsa romantica&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00&parameter=descargar pack de musica salsa romantica&ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=descargar pack de musica salsa romantica_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=descargar pack de musica salsa romantica&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00&parameter=descargar pack de musica salsa romantica&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00&parameter=descargar pack de musica salsa romantica&ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00

http://download.aminst.net/.../get.php?q=descargar pack de musica salsa romantica&ti1=700000&ti2=0&ti3=2013-10-13T00:19:37.313303 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3516&instid[appname]=once.upon.a.time.303.hdtv lol.mp4_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=once.upon.a.time.303.hdtv lol.mp4&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-15T00:11:13.193245 00:00&parameter=once.upon.a.time.303.hdtv lol.mp4&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-15T00:11:13.193245 00:00&parameter=once.upon.a.time.303.hdtv lol.mp4&ti1=500000&ti2=0&ti3=2013-10-15T00:11:13.193245 00:00

http://download.aminst.net/.../get.php?q=once.upon.a.time.303.hdtv-lol.mp4&ti1=500000&ti2=0&ti3=2013-10-15T00:11:13.193245 00:00

http://www.worthdownload.com/download.php?version=1.1.5.98&campid=3038&instid[appname]=Millers.flv.flv_Downloader&instid[appsetupurl]=http://download.aminst.net/d1/setup.exe&instid[cmdline]=/S&instid[appimageurl]=http://download.aminst.net/d1/logo150x150.png&prefix=Millers.flv.flv&instid[thankyoupage]=http://download.aminst.net/.../thank_you.php?ti1=500000&ti2=0&ti3=2013-10-13T05:37:12.983872 00:00&parameter=Millers.flv.flv&instid[interrupted]=http://download.aminst.net/.../interrupted.php?ti1=500000&ti2=0&ti3=2013-10-13T05:37:12.983872 00:00&parameter=Millers.flv.flv&ti1=500000&ti2=0&ti3=2013-10-13T05:37:12.983872 00:00

Latest 30 of 54 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to www.softologic.com (174.37.181.31:80)

TCP (HTTP SSL):

Connects to www.ibbalance.com (173.192.190.227:443)

Remove setup__2738_il4190458.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.