home

vso convertxtodvd 5.2.0.26 multilingual portable.rar__3038_i1387126668_il261088.exe

Shetef Solutions & Consulting (1998) Ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application vso convertxtodvd 5.2.0.26 multilingual portable.rar__3038_i1387126668_il261088.exe by Shetef Solutions & Consulting (1998) has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install.
Publisher:
Shetef Solutions & Consulting (1998) Ltd.  (signed and verified)

Version:
1.1.8.22

MD5:
611f9296bc99462406df25978a1af24c

SHA-1:
a367b7b52c28531372a4153bd2f0491bdd7ca072

SHA-256:
0ca0016ea78c7a8c795d188668234c963badd03fdb48a51efa3caa72a2e19feb

Scanner detections:
22 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 4:55:01 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Graftor.161610
830

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetize
2014.10.28

Avira AntiVirus
Adware/Amonetize.519376.14
7.11.181.132

avast!
Win32:Adware-gen [Adw]
2014.9-141027

AVG
Ukra
2015.0.3307

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141027

Bitdefender
Gen:Variant.Graftor.161610
1.0.20.1500

Dr.Web
Adware.Downware.8876
9.0.1.0300

Emsisoft Anti-Malware
Gen:Variant.Graftor.161610
8.14.10.27.04

ESET NOD32
Win32/Amonetize.BW (variant)
8.10628

Fortinet FortiGate
Adware/Amonetize
10/29/2014

F-Prot
W32/A-6c30e7fe
v6.4.7.1.166

F-Secure
Gen:Variant.Graftor.161610
11.2014-27-10_2

G Data
Gen:Variant.Graftor.161610
14.10.24

Kaspersky
not-a-virus:AdWare.Win32.Amonetize
14.0.0.3028

Malwarebytes
PUP.Optional.Amonetize
v2014.10.27.04

McAfee
Artemis!611F9296BC99
5600.6964

MicroWorld eScan
Gen:Variant.Graftor.161218
15.0.0.900

NANO AntiVirus
Riskware.Win32.Downware.dhaxhs
0.28.2.62841

Reason Heuristics
PUP.Installer.ShetefSolutionsConsulting1998.?
14.10.27.16

Sophos
Amonetize
4.98

File size:
454.1 KB (464,976 bytes)

Product version:
1.1.8.22

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\vso convertxtodvd 5.2.0.26 multilingual portable.rar__3038_i1387126668_il261088.exe

Digital Signature
Signed by:
Shetef Solutions & Consulting (1998) Ltd.

Authority:
GoDaddy.com, Inc.

Valid from:
10/13/2014 10:02:37 AM

Valid to:
10/13/2015 10:02:37 AM

Subject:
CN=Shetef Solutions & Consulting (1998) Ltd., O=Shetef Solutions & Consulting (1998) Ltd., L=Rannana, S=Israel, C=IL

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B1B72BCEFC0E8

File PE Metadata
Compilation timestamp:
10/20/2014 3:33:52 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:DIc0x8bs/GQY5quuEviJ3uDnGFgdGohHWPq1ini6JgVo:DIvKbhRK6HTHgPJgVo

Entry address:
0x11DE8

Entry point:
E8, 49, 6A, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 94, 1E, 3B, 00, 00, 75, 18, E8, 5C, 4E, 00, 00, 6A, 1E, E8, A6, 4C, 00, 00, 68, FF, 00, 00, 00, E8, F9, F5, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 94, 1E, 3B, 00, FF, 15, 14, A1, 3A, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 94, 1E, 3B, 00, 00, 75, 18, E8, 12, 4E, 00, 00, 6A, 1E, E8, 5C, 4C, 00, 00, 68, FF, 00, 00, 00, E8, AF, F5, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Entropy:
7.4106

Code size:
161 KB (164,864 bytes)

The file vso convertxtodvd 5.2.0.26 multilingual portable.rar__3038_i1387126668_il261088.exe has been seen being distributed by the following 5 URLs.

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3039&instid[appname]=chito cano biografia_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1460000&ti2=0&ti3=DD1_2014-10-27T18:23:43.615483 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=chito cano biografia&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1460000&ti2=0&ti3=DD1_2014-10-27T18:23:43.615483 00:00&parameter=chito cano biografia&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1460000&ti2=0&ti3=DD1_2014-10-27T18:23:43.615483 00:00&parameter=chito cano biografia&ti1=1460000&ti2=0&ti3=DD1_2014-10-27T18:23:43.615483 00:00

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3515&instid[appname]=country report template for kids_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1460000&ti2=0&ti3=DD1_2014-10-27T20:35:01.826418 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=country report template for kids&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1460000&ti2=0&ti3=DD1_2014-10-27T20:35:01.826418 00:00&parameter=country report template for kids&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1460000&ti2=0&ti3=DD1_2014-10-27T20:35:01.826418 00:00&parameter=country report template for kids&ti1=1460000&ti2=0&ti3=DD1_2014-10-27T20:35:01.826418 00:00

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3038&instid[appname]=VSO ConvertXtoDVD 5.2.0.26 Multilingual Portable.rar_Downloader&instid[appsetupurl]=http://go.venturecdn.com/getfast/download.cgi?9&ti1=1005000&ti2=1&ti3=2014-10-27T17:51:06.515163 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.venturecdn.com/d1/logo150x150.png&prefix=VSO ConvertXtoDVD 5.2.0.26 Multilingual Portable.rar&instid[thankyoupage]=http://download.venturecdn.com/.../thank_you.php?ti1=1005000&ti2=1&ti3=2014-10-27T17:51:06.515163 00:00&parameter=VSO ConvertXtoDVD 5.2.0.26 Multilingual Portable.rar&instid[interrupted]=http://download.venturecdn.com/.../interrupted.php?ti1=1005000&ti2=1&ti3=2014-10-27T17:51:06.515163 00:00&parameter=VSO ConvertXtoDVD 5.2.0.26 Multilingual Porta

http://www-vanilla1.fb-hosting-apps.com/download.php?version=1.1.8.22&campid=3516&instid[appname]=aci 530 05 pdf_Downloader&instid[appsetupurl]=http://go.downloadboutique.com/getfast/download.cgi?9&ti1=1500000&ti2=0&ti3=DD1_2014-10-27T20:55:29.141804 00:00&instid[cmdline]=/S /PERFORMINSTALL /NORUN&instid[appimageurl]=http://download.downloadboutique.com/d1/logo150x150.png&prefix=aci 530 05 pdf&instid[thankyoupage]=http://download.downloadboutique.com/.../thank_you.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-27T20:55:29.141804 00:00&parameter=aci 530 05 pdf&instid[interrupted]=http://download.downloadboutique.com/.../interrupted.php?ti1=1500000&ti2=0&ti3=DD1_2014-10-27T20:55:29.141804 00:00&parameter=aci 530 05 pdf&ti1=1500000&ti2=0&ti3=DD1_2014-10-27T20:55:29.141804 00:00

http://download.venturecdn.com/.../get.php?q=VSO ConvertXtoDVD 5.2.0.26 Multilingual Portable.rar&ti1=1005000&ti2=1&ti3=2014-10-27T17:51:06.515163 00:00

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.