yet_another_cleaner_dnf.exe

YAC Security Protection

Elex do Brasil Participações Ltda

The application yet_another_cleaner_dnf.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.yac.mx and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
Setup

Version:
1.0.34.14548

MD5:
1c56dcb02a9d2a34b248de3b06d643a3

SHA-1:
79edead2c4ec209bf9e72d06fcec548662e8798a

SHA-256:
b44059164a7cb031fa3158bec9be2765ee2a69924ab1f41a4e05a45b31be1537

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 3:57:03 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.Installer.X
14.8.18.13

File size:
845.2 KB (865,480 bytes)

Product version:
1.0.34.14548

Copyright:
Copyright (c) 2011-2014 Elex do Brasil Participações Ltda

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_dnf.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
6/23/2014 2:00:00 AM

Valid to:
6/21/2015 1:59:59 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=São Paulo, S=São Paulo, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5C6950D0A05A1CD63164D1E1EB1FFB8A

File PE Metadata
Compilation timestamp:
8/18/2014 9:12:52 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:4GnFJ0WKrHgIbqMiLliDAKFUn9HIlCrlwcQkti4XAfdrsTNxjPak:4GnzwAIuMkkDAOW2cAFr8NZH

Entry address:
0x109E3

Entry point:
E8, DB, 67, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 83, EC, 10, FF, 75, 0C, 8D, 4D, F0, E8, 73, FA, FF, FF, 8B, 4D, F0, 83, 79, 74, 01, 7E, 15, 8D, 45, F0, 50, 6A, 04, FF, 75, 08, E8, F0, 68, 00, 00, 83, C4, 0C, 8B, C8, EB, 10, 8B, 89, 90, 00, 00, 00, 8B, 45, 08, 0F, B7, 0C, 41, 83, E1, 04, 80, 7D, FC, 00, 74, 07, 8B, 45, F8, 83, 60, 70, FD, 8B, C1, C9, C3, 55, 8B, EC, 83, 3D, D8, 61, 43, 00, 00, 75, 11, 8B, 4D, 08, A1, 40, 3F, 43, 00, 0F, B7, 04, 48, 83, E0, 04, 5D, C3, 6A, 00, FF, 75, 08, E8, 89, FF, FF...
 
[+]

Entropy:
7.3125

Code size:
140.5 KB (143,872 bytes)

The file yet_another_cleaner_dnf.exe has been seen being distributed by the following 50 URLs.

http://www.yac.mx/download/.../down.php?pt=mmac

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=Ae9ra8vrLytzgzOMp5tqadr9KEW5B9__7d_nlnPDO6ZtO83dIGv6CNKm8R3RvfuyMqsr9P_3LnoAiVScQ5G_NJoNEePCRP4ziokcdeDaNPVq49gaxXDpRnJ1SlRVaoXDd8wkvVPxl4vJ5Aj7TayMIrTgHXeiYoSQ5I4eAN4cuOZH5DjEmN6u0-8CCrVJogmkUTR62D0nPgC1kHgnf2vaZGyfE5J4O6SAAfZvGfNgVkEQ4xclnjsggR5l7e9PsxoEH5oJ4UaNscEB-73PDDhaUFcjO_SXt5vpqYdUk51kPxAQn5gnsH8iB-AxSf0sjznI48rSRmjW_Pe5bB5uUyEoLTYpPppHF1_6mK2gQybJR6TS54Tf0xlemnadRbK7ngQSvh-w6ym-xw-aSjDzhs5G4YrYvDOBMe96lt4iEW06jA&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=RsA1y6xTRbGKRhRZ3iIQAqE_FN3yAOqJ9lwJa78BWel7KKjIqh1a3aZUneWzVNmV-HJj5JhPak8AAYh0Lzaaeh9P3LrTBbHfqypgIUhgju2H77uDTRF5Wdt06b5xNRXAZMB8uCuxYXJywVTOZAHEpa-9CF9EAKWdrXHyhd4JzJs-JbiLFTwh5RTxUHEsPCrjjTro3z_NMIneAS0Hv3v32yZRpRPJUT4DJWtYvQPss03fVc7IM7o3bsclP84GfyZauj8KuXlDh7B97E7a9i5FK-Y8fCc9ZlqVd9mhaJXcGYBOHX5peMegEQ0mx2aoZcLog161xzLE0NqyhwEsxjleWMEpzdJTBxDUSEQvQS6VaKVe88DAzmupEOrEXpJeSNP8xITGm3UQUNOxebqpcU4BtisPC67_Bie0_RFXONCHqsO-IC_7bVAQ1O8Xnw&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

https://adsrvmedia.adk2.net/event/click/0/Z_FxNPk_34VFRjOFGjmOUJyW1wuz0vybpl3SorcYS5s5BxV_sumPR5IGAEzbRvGk3M8qskJRAoQLdV9ijrmDIF966aupuKSFkGQufHiKmoeylELSBbezAUUS_IH6fpkN_rhU6BOfPLVWTpmomIw3UcLGtkwodJMbqc9HsF6a40tSldzglJ4JAv0eKfNFb4QATApfyLBXww4dkipJrDNovMyHjLaJ_ks39WS_Wj8TyPDr0rKrbkyYpliC8VUO-0iWP50wzZ3vSaBsUeViOFtrfX8R1AwUjF6Qm3_yOR2X1bRPQXz8mPZum7dnmIuYBCnVBicf6Ykcxf8kP8G2GHHWdkexCho-3lTb6U2r2v4vwI0AfC1fijHzfTpkMXvU16Z9vVc7M-QUpzONLlQ_NbrHjWAzBVu0v2jGAC9H59WJ4aXvg_uEE6seng/.../

http://www.yac.mx/download/.../down.php?pt=dnp

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=Nomf1-kIXVb_HUVjPefL08MqUsNlRruGi2AtZ6j5xhphPIBEpCiUNaxIc_zLkHCu1ry8p793FKVyVww6BnCAhE8u-tIz4VAZi6aA3CDrAbhj606W05hWw47prZQlWdP5Xddv3VBe86-n2jgHnfFEu3rDsY-dow5wf4DPQGlGHkk_AK3jt74ad8FDzl61Cp6ceSz7L_5T52Ry0DXxANZM7tTYoT8Wdkuxa1nIp5gm2B0d1O1w4Dt9kfiaJhPdxwqcSddzmt-OwFTJW5FEx_zik6CFWLTxzi2vyE1g7BoAFhaMRcZRRUliUxjQMGHVkq8Pwsr6zpQSSJvinUPTZWVCsaIAr24gmh4YvQwP9DAQUuE0RyunhWmwo3u1PCgrNx0tSRO9Hk98xB6V4TO-8TxY9TfvwXvJFie6EdzB_l6UY0baQjY1ToMUwtAAVu0mjtJkrNdzflZiQx9899EjoWQGUcj5cCWJFXdTwJ6VjqwzGbMvhTtt&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=l-n8tQeu9xKtj6kTWo7nDaesgsq38pQEiL7c2v5V3urNh1zlbekgiJPGVSanvGkhxFyx6glUnRVNO5BkM0851Kvaw7uuk2TnjMrJmaa5jbXzyh9_lVOqVSXd0MfzzgsQFkY6vaAoBdjSAPm0BJN6-NGOpJrkZZsnLASYxV50c1kol15E5BZ9JUrXDl1QEHGlNrnlimBycOdOWjSGhzs6QDXm3iMcVLU2uSnneA5VYJkmPR2sW9KQ9iiliMB2MPv8T-CXLMdIerYA73ZcBTa7tkXFIdbZxHv16nYiJYLrOJzjSIFYh9xzSKVdsUxSuOWSHptd-PQcFwTKnojDbYycmJ36nATQBaAvzqxj3gOyHUy9TtVPo6y5D6hSPpr8d3K3YGXF2Ug5KGh1wjgKYm1jfQdtUiNu4QGoZtveR1oaYJxCLcjixBDKhio9e_JXth58vHLLN_sr0A&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=munb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=0415r0hiPrKVzt0QWV4BSHEEIRjsmtZtanW2Mk4IBq1Y9RN4RT72IoTSBGv9Jly6ain0Q9py9-yHo4TcuZPZ5wL3iO0U-bR7H1hW0Lmfk7TkW-c3TfSwvmkG7Y8Vo81-EGE1jPB6mF7axBGqWg0NcyaoepH4ynX5Exs4m-Ei51paGnQGQqjCPRVeo2vvlX-dkts5iy_visZZROYOgEdNd7ct02hOqnWiAcAXBrpY6PyFACDXf6Pa_ANqirVyqz8XvvsZjFAy-6qH1EMBX5narABEU6ezfola8lZhsY4J8c2uBrkguQOZxNb6Lh6BEoaXWr0PNvpSSfxJW8mVPGYGPzafYHs1UQ5Vrfz0eiMPYgVVby0wK-vhpkagmucy556LB6csyA9kInCnp7YLVG4_qQk&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=xtva

https://adsrvmedia.adk2.net/event/click/0/9T9Myh-nJqsUTH-r1M4_88EQnxqBBrf6pSfypZ7DJDA0ZKG_q6swqDjGNbRkUSh6eFMC_z6U_Zx4NOi_7e9qTR1Jmgm6pePzw-lt8abP4sDUKiGvdKohKxZFpQGx0UIqZWsURyvfVIT8_OyF7F9_msWOJ1-viHAujdkFv96rgHjnEMbaikRX5A3qUh1jP_Jzmg4fN8mNviGJBEN681SrmeNnWLxBTKOsaRebdEhyWv3wF8m6_tTCuKvwYPLPnTRkhGYoaiHC0_wycu373kjWgMMuZfx2f4W-Sw1ujzat3SIVblrANol8lsfvu_1x9zten2DZlDexeZ2ULI5hkleRKGXHcPjL5zwGBsXBkNR6C2WCnmcO8h-3qd55ZJrc7azLfHCJNPGqKImauBCLdC3BwEbqT6JVSlE/.../

http://ads.adsrvmedia.com/event/click/0/6x2x8vLHkXU34MqVHCd2--t3uLkhoP2tgtC42DAQQxFBpu7ct5Xo4w7DLPS3pZR1MUp-4IVjVrHytgHfGnErnqVFOFcCq5i4keswRGZnO2LV-PYYkT7GIuqweJJ-W3T0IBz-yuY67_aVyOOffIPIgtRTGDfbWLh4-qBTLjIytbbhvPrFyjrgoI_SbQdiAuuZG7LQIxhEHOShtkNtz_MYxfAQtFmKu6r2_ISTndZ7P9qq7y1IYT7uzAv3Cd62pP4ULMS5OVfGdFFAsAN2dsZBvgykM35Qdh-gffLsg69g42l4xlzeF-HCoBUaI3yVdNedAohZXfzj2DKi6kjFSBjnkhvIAU7_wbwPdWBiQvOIqK2cEp0rI0rjdRD7hHodMvzhJE3hgvH2_R-q01IoeAFeDnjZZrCj/.../

https://adsrvmedia.adk2.net/event/click/0/lwHl6gneWAsKnLEhUFMWFC3tLqQ3Zli4aAuQoU2_loYgzuD6Hp4lwetzCeNTjuy-0OgwkeTb9R_uRDQZsy_WLQjnCr2dQj6R37mB8B9kjZdYT2YIg56N5xjgC8-CFjtMeNhRMGImI5mRc69Z3_Gj0ZUg0I0wsDKxrYjWsZOyP-whg8Fi8OBXeF5s-Zknxf_GavnGRSE2AW8JTLeTjha2DuYae4ujmruNT3RczO-ddu0Tz9S8PL4Iq_XecRxyPuQVFE33fK6m6TTzd6q4iuxP2DCLjhjxLj9BGI2v3w705ZpxEwl76rZJ3GgVLvIB8Nt9spFUHkPH2DXw2ervJGw5DQPdY3caIathTN2K4hqs2YYgPl6otcUNIC5TPIPysxHL7e3q-6Lc4slm6IfTdcIZqfKIUVIOoUWTNtQGxDGUUBt_pKhHJbBwsVieSWqy/.../

http://ads.adk2.com/event/click/0/-C3yRHrz0l8Sm7YDMop0gAgjBuBCnjsMCqAL_3QTPBWnjOkHj32xMky0whkFCcHiWqRVejlPv1zY3I6lVLigFZYv1KirM8lq_xSMsN9a_C7UnGPC85Wa5-NstqDcxTdWW7MzMPh-nC8-dWYCky8lz5_jjAVJIEuzmWdA10J-vOIYnnzn10f0tsjS18tjub2F1_O76fNw_rzymNejGEAb_tBNKWMlWs6qcZgd6K9q9TI8xTKPaUNNJnHExSjXvOhX5f2KR3GsdVznjmBJF8Y3E6OwGmwIKbtZn1WZVUX6JKzhCmZY8GDvGKSmBvd4vbTbTmgBUzinj4cSYwjZIqhYikJ71ieR0B9kZvOsDKN1zkwoZrcMrJ_s-H2wd5ZP_PLJNcXUVACV7v2vvpT0jvotADbvgq3-G6Vz9hFjlF8Uoket_6OMwa3b/.../

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=brog&subid=CVeRk_P_p-7i5w0vC4r3iSDwRTIAsRbuJe10OHREi3NNk0MOBe-FV1kovxBn62GKHT4HHo02EhP1F8kndQ8SSfpymt861L5IFwpkXsdGOthg30sajAySqydC1s5Lj520ENWdaIW6gUxWB_njdrLJ3K5swknEONZTgph_RJlxJB8A38mtPbyvq7-4b_efGowND1trivEGNvlUso7CG6CMhwDi6EhudWYniqVv_px1Zo3PxL_1Qr5-hzm5aLqnW60ezUvme3LoXWxEivMygMQ-38rgCmfDSXqKuobLrTb28TekrrdeB7wVHd3mCBrSjPzKjMW-QTh7hAFypj5sBtjdPcISz42giRZmw14jcjMyW_ZoLBhA0XgORMEZopJOg2f3BuJHLJdAcl6OpmxrbLkUHZNdKzOYGnUGVxeNL5c2ynqPhxXqb5zuHBc0gn4dRw&lplink=http://www.yac.mx/download/.../down.php?pt=brog

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=CXdwWco3nAV5jVVFSmWk23nfngL3T08xA7tF-ecd3YHiZfvzPa7f3UH-1OYxHDAOTw2IfGPRgU2IpvwQ1IbRYYBGpoVbjxFi6qtAYOj_pfXqiL4BXQeGcq6YyZkX9_u9_sYHxJG-sajbYTz9tTmfhH24EbGgfnRuY2TFrqRx5BHwO4azagHIs8g5JjdANYpeKyLp2ORETs9B2DWPOCy_S51XuiMZwbVYu5jSSlysbTFcAc_-ir9m6BNZXAgQrYI1z070nCAo5fB-CHODtzzh17bL0aM9Nzc9Ecdiq3l0pioe4ad_pPkPfugOOSyOkjOsQrtdKohqnuVN2o5Hrgs9ft7NmfLs0ib2gcbJ9F6tM-iMqdQSOoj5lISmh-2v3i8b6hrO3WvfJb9snZdfhmvEVdfUwsCtctlEJAsJjD5iy47gn4IoKTKt8wA2mo8JOTLpUe_HKHHSCYgEzbJfVtksygVL_A&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=X7C_Bu-Ic-akuAhKQUpZLXU9-T6DDCPMBd4-k0SI9ZO4-gC-m1wIKSfco6O9l0GaQbKetR6DwRd8YdV1VcwNi9stVU40Vz0_VDY14BTMn3BHq-H3hOllitE4zVJJD5MsN0nWU-_UgyEjWR88HZd8nFFqWLDRsp4-i7xEKHFDdByYKDhm_cuMiGNDPyRIJPpzKraq8fqNbfMy8cEh2aY8lRLu4DwNkZX_9wKj6ZF98Eze8Y3DU89UP8DxO_JIqDUMg7TvfUACSZYLMQ9-RqTXMeUwWTGsbJ1d_xYnSfkgxolHZszrXBAvcY8Mz9OPLgYt8utPNIUdM5doF3opioQPrI22mZjLqSZcJbZ90u7T5WSVTtBwx1c3EKvE6LOE3RVleHuHQlpjtViJm05B9ArH-HTAgvQXa8YV1P_osObGEmJqTB6lsqlwEwJFhRaQG1rBGvcgdKYyqk6PCf0HV3MTHcs&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=mmacn&subid=rj1ULGJz9HhlRz3-45ABJMRT3gszwf4OnjkjFOU69pd18o0nozfI9RcptbQ7gYckJyfYxhxckXZBsGmYtoG4mHlUyIsHFxU2KxRnBKj3wLHmmpymXQVaIzUL4Lv7__cVRuGCJ7v8vHMT0PIXNAhN-zUGpn1W0sAh12AeEoXRrZy4ziZU7hemHO5N2l2T7HH_yTP7h6SUa-HO23KGzUL8qfB7McU8b0_Oe5vukdrX-j28ekuRhkdZc5F3_5fXbr-m26SQSykPw8O6urWFrbwiHjBDWW-DEf7jUuzJAatfyyAQSLYVkkGf2tzg1zOiU68FJ570ZggQQWPuVpcZCItwZXfRW1DbUnGqrsEdfjAwkC17ba5zlcTBmYm-S2pxb_jmk-P6hSZiD39bob6uwQnZsjMXTaoBWsZdxI0vfPMzASjhuxgG6c9Bdw&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=brog&subid=VeszCiip_BtRs_iUDpZCN-aAZMLS4t0DCd_uvffb9SXS9BtQ52ZlYdrHvZd61-KphTxnO0DW5xtYPjm-VglFOR53_w3P7PQ8iQJ71_EGFxaLJAcOKL3yVsfBPHrJfoGgAobWN-et46QU1uBU9w0kt0ITJma84d6-T-kc8DPPC5CMAPUP-9Ll8MgHj3WSNKs7ZgYzYtzV1DsWuU1oZ_W6fmInz1b5m-HGpFFYklaho2qvCfpNYeE1p7HfLBSXv8hXs6Di_14ohNtEPI4tUNbzbWAQc31KhFfSSTDOgQGBHt1akS3uzLgAFJTsVu4acMvDPfQtSa2Xr73yimiVGS2e2cnjhncOjpsi3DeuQCh5UzffYMFvNz-wSEVw47GcH71kKdi6Yo3IDwfTtbdsyFzsTR7a&lplink=http://www.yac.mx/download/.../down.php?pt=brog

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=brog&subid=rbecGijolfNAPvkiMDYJBuS8Nr3VOBLDH6BHHcQyM_FuDi4V8Z9pGAzBvltfODNbCHA-Ovsn2JU25yd2zr9rYBbPjjXbJNP1g2ixNtF3Wvtp6PVNZqXJfTrz8ZThbbwErC6Kdy-utBzZtTGYl9DDHwopSUjb1eqzbczxUTuuaoyCL_Wci_pK50OfjkSl9zw6QOMZJdOI7mW9FD-sxNnuKGhQoYxp7XLPT2qjWJfSIzk9vglNT_bH63xJ9eqwvUnT8XpLkRbQN3Uh1E1dXPSyEAKFWo25SwAsh7VwY2tllw44puFnIp0cMIWlHa68ZzlgvN_GguR8KECKimfeWPnhUcB4SgoykhCYP9ZB34UEcUVXOjD0gGBpL12hEWaNwvIuTqQMugB_19Z0dXLD5c68xmEUTJrCvgTfd6lom_Dkp_CElvhu5Bf5uhaa-k72-X6XkzgEdwNI_Xj9TRE-AoC4TyJFN-JYISk&lplink=http://www.yac.mx/download/.../down.php?pt=brog

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=brog&subid=_2sCIzrNkYebLJJgb_g0ctdf6RfD_nsQSOZdf86OxnBSHluWkq-WEduwRMivhsJ28ApsAJ9hsv8N20OodiIkU_o9k-qZYk7btN9uOOrC7w8lP01-balQIjHCLKECfRYB5RHrxB6SbjpO_fnN7bNPkp0TRoEHeDumVEBQYGjkVSWbFk7fc2YgY_MnZQPVp95U7J9st9pIDfkvmWjrHf7J5xKEqh9_mj4s_ahnG6UBDGO9TjmRMI9ijoq0N9T1DyGpzlmzHVo4Uh3C33BSzV7V8bJxZRLK6bj1jzuxrCCyO262kYEd0tqZ45ITh1eo-a8S3grCIKITqK8ta4jPAynFVQ29Hd-hhXcrv4f8FBf3_5dB5SF7RS1V-hK-KbWakQxRRwURJJ4l88W6QMZXyKTaVbmE8ir3Sp15Wco3HhVShxFeuoryVmi_CjRm-Pn2Ub7rauC060BEF9FfeenRczZk&lplink=http://www.yac.mx/download/.../down.php?pt=brog

https://adsrvmedia.adk2.net/event/click/0/QsSLEe7gvW09okgaLqTseV4N-37LvdXslbWjvWsKhEZwbkSJ8i6okS-vgLnk7sH19Js3qIAwc7fEHRUni_D708aP-LuqXuj8kR1W9u7rV57uKAG_rkM4cMW2j8BopqukIpWlTtr0N5ZO-JOvdobjJgzv19isgWj6sSdHvPAER77miC3WbdkJNx_3J1gPpMyqB06ix37MKK4YE5sQJVg2sf0jb5TNolRo5G5lQG0MhKHhSxSatkGcSGUqF3fGkwDRSmXjpstLb_pqpQxfAmQCjLexw2qmWF5akYeSwc-eqkI4nJXw2c9jyESKWb3rxN2wGQUzWczKSx9IzZk5CdWqRTxd7NaPKgsB7SnqGrNzcvM_aziQHz5DyObxGPbgE420-YiAlQ3dyRXQmLSa_HPgRJk/.../

Latest 30 of 115 download URLs

Remove yet_another_cleaner_dnf.exe - Powered by Reason Core Security