home

skype blocker v5 92__3516_i1373569203_il1184367.exe

Ukra-2006 LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application skype blocker v5 92__3516_i1373569203_il1184367.exe by Ukra-2006 has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Ukra-2006 LLC  (signed and verified)

Version:
1.1.8.22

MD5:
6647436020df079b45daf2542d75061d

SHA-1:
9ba5b2cf7d72dd7e2991311634b12d4aece47537

SHA-256:
72d118b85cc7f44fab9b9441055b4ba0df6c84311495fd13f584938b3850bb87

Scanner detections:
13 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 5:00:46 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetize
2014.10.15

Avira AntiVirus
ADWARE/Adware.Gen4
7.11.179.100

AVG
Ukra
2015.0.3321

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141015

Dr.Web
Adware.Downware.8818
9.0.1.0288

ESET NOD32
Win32/Amonetize.BT (variant)
8.10567

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.3098

Malwarebytes
PUP.Optional.Amonetize
v2014.10.15.10

McAfee
Artemis!7C254E3442E5
5600.6972

NANO AntiVirus
Riskware.Win32.Downware.dgsnhp
0.28.2.62671

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Ukra2006.p
14.10.15.10

Sophos
Amonetize
4.98

File size:
412.2 KB (422,096 bytes)

Product version:
1.1.8.22

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\skype blocker v5 92__3516_i1373569203_il1184367.exe

Digital Signature
Signed by:
Ukra-2006 LLC

Authority:
Thawte, Inc.

Valid from:
7/1/2014 2:00:00 AM

Valid to:
7/2/2015 1:59:59 AM

Subject:
CN=Ukra-2006 LLC, O=Ukra-2006 LLC, L=Kharkiv, S=Harkivska obl, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2B3200D1AF3CAC4253C00F000EF4BAB9

File PE Metadata
Compilation timestamp:
10/14/2014 12:21:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:iE5kxbDL5oOlyOJjmplTBSaRpgEvXeuN2sK/lR2Gb:55kR20VmrTwacEvXJI3dR26

Entry address:
0x11D8A

Entry point:
E8, E8, 69, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 9C, 5E, 3C, 00, 00, 75, 18, E8, C7, 5E, 00, 00, 6A, 1E, E8, 11, 5D, 00, 00, 68, FF, 00, 00, 00, E8, 7C, F3, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 9C, 5E, 3C, 00, FF, 15, EC, A0, 3B, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 9C, 5E, 3C, 00, 00, 75, 18, E8, 7D, 5E, 00, 00, 6A, 1E, E8, C7, 5C, 00, 00, 68, FF, 00, 00, 00, E8, 32, F3, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Code size:
163 KB (166,912 bytes)

The file skype blocker v5 92__3516_i1373569203_il1184367.exe has been seen being distributed by the following 6 URLs.

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=jl cmder v1.9.4 zip_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T13:33:30.361569+00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=jl cmder v1.9.4 zip&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T13:33:30.361569+00:00&parameter=jl cmder v1.9.4 zip&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T13:33:30.361569+00:00&parameter=jl cmder v1.9.4 zip&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T13:33:30.361569 00:00

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=asme b1 1_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T14:43:08.138294+00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=asme b1 1&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T14:43:08.138294+00:00&parameter=asme b1 1&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T14:43:08.138294+00:00&parameter=asme b1 1&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T14:43:08.138294 00:00

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=blog musique aim a nou_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:35:44.796737 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=blog musique aim a nou&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:35:44.796737 00:00&parameter=blog musique aim a nou&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:35:44.796737 00:00&parameter=blog musique aim a nou&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:35:44.796737 00:00

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3515&instid[appname]=dell 5530 broadband manager_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:09:05.066319 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=dell 5530 broadband manager&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:09:05.066319 00:00&parameter=dell 5530 broadband manager&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:09:05.066319 00:00&parameter=dell 5530 broadband manager&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:09:05.066319 00:00

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3516&instid[appname]=hdd regenerator 1.71 full version_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:25:02.299759 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=hdd regenerator 1.71 full version&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:25:02.299759 00:00&parameter=hdd regenerator 1.71 full version&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15:25:02.299759 00:00&parameter=hdd regenerator 1.71 full version&ti1=1405000&ti2=0&ti3=DD1_2014-10-15T15%3

http://www-squid.cluster12.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=world clock widget xp_Downloader&instid[appsetupurl]=http://go.edgydownload.com/getfast/download.cgi?9&ti1=1405000&ti2=2&ti3=DD1_2014-10-15T16:48:20.835973 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.edgydownload.com/d1/logo150x150.png&prefix=world clock widget xp&instid[thankyoupage]=http://download.edgydownload.com/.../thank_you.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-15T16:48:20.835973 00:00&parameter=world clock widget xp&instid[interrupted]=http://download.edgydownload.com/.../interrupted.php?ti1=1405000&ti2=2&ti3=DD1_2014-10-15T16:48:20.835973 00:00&parameter=world clock widget xp&ti1=1405000&ti2=2&ti3=DD1_2014-10-15T16:48:20.835973 00:00

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.