» setup__9581_il895.exe
Overview
Analysis
File Details
Downloads (19)

setup__9581_il895.exe

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup__9581_il895.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.

File name:

Publisher:

Shetef Solutions & Consulting (1998) Ltd. (signed and verified)

Version:

1.1.5.26

MD5:

113694db6be070f7479b097b7fd82402

SHA-1:

a192680df3ea3cb710e35bc0a4bacf9a5c210aa3

SHA-256:

20f0b71fdcc97b38b02d6d3d673f07e8727e3f7e2f5bd8b868d4a199e31ff71d

Scanner detections:

12 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/23/2024 10:53:54 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.11.07

Avira AntiVirus

ADWARE/Adware.Gen4

7.11.183.128

AVG

Generic

2015.0.3298

Dr.Web

Adware.Downware.8996

9.0.1.0310

ESET NOD32

Win32/Amonetize.BY (variant)

8.10681

Fortinet FortiGate

Riskware/Amonetize

11/6/2014

K7 AntiVirus

Unwanted-Program

13.185.13930

Malwarebytes

PUP.Optional.Amonetize

v2014.11.06.01

NANO AntiVirus

Riskware.Win32.Downware.difhzb

0.28.6.62995

Reason Heuristics

PUP.Installer.ShetefSolutionsConsulting1998.R

14.11.6.13

Sophos

Generic PUA KB

4.98

File size:

486.1 KB (497,744 bytes)

Product version:

1.1.5.26

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\setup__9581_il895.exe

Digital Signature

Signed by:

Shetef Solutions & Consulting (1998) Ltd.

Authority:

GoDaddy.com, Inc.

Valid from:

10/13/2014 2:02:37 AM

Valid to:

10/13/2015 2:02:37 AM

Subject:

CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4B1B72BCEFC0E8

File PE Metadata

Compilation timestamp:

10/29/2014 3:41:41 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:TLFU2oitpf5hCPFZYdfUUXlz8Vh1FPj9Q4OyPak1rFL:T2ztZYRUTr91OyaIrFL

Entry address:

0x13CF6

Entry point:

E8, A8, 75, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, BC, A1, 3B, 00, 00, 75, 18, E8, 5E, 4E, 00, 00, 6A, 1E, E8, A8, 4C, 00, 00, 68, FF, 00, 00, 00, E8, 60, F5, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, BC, A1, 3B, 00, FF, 15, F8, 10, 3B, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, BC, A1, 3B, 00, 00, 75, 18, E8, 14, 4E, 00, 00, 6A, 1E, E8, 5E, 4C, 00, 00, 68, FF, 00, 00, 00, E8, 16, F5, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3... 
[+]

Entropy:

7.3795

Code size:

191 KB (195,584 bytes)

The file setup__9581_il895.exe has been seen being distributed by the following 19 URLs.

http://www.fetch-files.com/.../Sylvester and Tweety in Cagey Capers__3435_il194043.exe

http://www.fetch-files.com/.../Mario Party 3__3435_il118563.exe

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=El Kit Tarot De Los Druidas Tarot Of The Druids K Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1329903616.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=El Kit Tarot De Los Druidas T Downloader&instid[interrupted]=http://.../?cancel&ti1=1329903616&instid[thankyoupage]=http://.../?success

http://www.fetch-files.com/.../SSD__3472_i1399131635_il406155.exe

http://softwarefreeupdates.com.pl/installer.php?aff=539&subaff=0&exename=Ares.exe&title=Ares File Downloader&description=Ares has been downloaded and enjoyed by millions of people spanning the globe. Initially formed as a spin-off of the Gnutella network, Ares quickly developed its own infrastructure and transitioned to its own Ares Download network.&downloadurl=http://ares.com/.../Ares_Setup.exe

http://softwarefreeupdates.com.pl/installer.php?aff=13&subaff=263&downloadurl=http://fpdownload.macromedia.com/get/flashplayer/pdc/.../install_flash_player.exe&exename=install_flash_player.exe&title=Adobe Flash Player&description=Adobe Flash Player"

http://yourfreedownloadsnow.com/download_direct.php?id=1813&name=Absentia.flv

http://stream.get-tune.net/file/212800870/206284432/773893793/.../Bombovye_Ezidy_-_Te_ka_lali_shpirt_(get-tune.net).mp3

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Book Downloader&instid[appsetupurl]=http://fastmediadownloads.com/.../Prompt-Downloader-1938114957.exe&instid[cmdline]=&instid[appimageurl]=http://promptdownloader.com/logo.png&prefix=Book Downloader&instid[interrupted]=http://promptdownloader.com/?cancel&ti1=1938114957&instid[thankyoupage]=http://depositfiles.com/.../some-movie

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Keygen Update 2014 By KeygenIX Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1719661602.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Keygen Update 2014 By Keyg Downloader&instid[interrupted]=http://.../?cancel&ti1=1719661602&instid[thankyoupage]=http://.../?success

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Called To Account Fourteen Financial Frauds That Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1453769844.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Called To Account Fourteen Fi Downloader&instid[interrupted]=http://.../?cancel&ti1=1453769844&instid[thankyoupage]=http://.../?success

http://www.fetch-files.com/.../Windows Loader 2.2.2__8173_il85.exe

http://www.fetch-files.com/.../chrome.am__8584_il328.exe

http://www.fetch-files.com/.../adobe illustrator c__7227_il36.exe

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Facebook Hack Tool March 2014 Released By HackSq Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1939329760.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Facebook Hack Tool March 201 Downloader&instid[interrupted]=http://.../?cancel&ti1=1939329760&instid[thankyoupage]=http://.../?success

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Avast License File 2015 Avastlic Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1725110504.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Avast License File 2015 Avast Downloader&instid[interrupted]=http://.../?cancel&ti1=1725110504&instid[thankyoupage]=http://.../?success

http://www.fetch-files.com/.../File.Downloader__9581_il141.exe

http://www.fetch-files.com/.../EuroTruckSimulator2KeyGeneratorSetup__6196_il7544.exe

http://www.fetch-files.com/.../Setup__9581_il895.exe

Remove setup__9581_il895.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.