home

yet_another_cleaner_matf.exe

yacdl

Elex do Brasil Participações Ltda

The application yet_another_cleaner_matf.exe, “standard installer” by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from s2s.yac.mx and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
yacdl

Description:
standard installer

Version:
1.0.72.19302

MD5:
4d09a3e4858b33c86798aaa616887668

SHA-1:
c61849d0c060be5baa197755924a1a797273524b

SHA-256:
e48a8e5f2e04d92e573b81c086e4a10640e3be7565d430c0b32dfeea94df35ea

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 4:52:29 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.Installer.Y
14.11.26.6

File size:
765 KB (783,352 bytes)

Product version:
1.0.72.19302

Copyright:
Copyright 2011-2014 Elex do Brasil Participações Ltda. All rights reserved.

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_matf.exe

Digital Signature
Signed by:
Elex do Brasil Participações Ltda

Authority:
VeriSign, Inc.

Valid from:
6/23/2014 3:00:00 AM

Valid to:
6/21/2015 2:59:59 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=São Paulo, S=São Paulo, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5C6950D0A05A1CD63164D1E1EB1FFB8A

File PE Metadata
Compilation timestamp:
3/22/2010 2:59:04 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:Sc/tb3x3PmXZcTpomt59FjkaeQSNPF8+kx1RSqfOFQcDhhxD9EmMsE:tVbheqTmeTkQQ9YRSqBYzD9EB3

Entry address:
0x114F

Entry point:
E9, AC, 55, 00, 00, E9, C7, 94, 00, 00, E9, 12, 99, 00, 00, E9, 6D, 94, 00, 00, E9, 88, A9, 00, 00, E9, 63, B9, 00, 00, E9, FE, 99, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC...
 
[+]

Packer / compiler:
Xtreme-Protector v1.05

Code size:
57 KB (58,368 bytes)

The file yet_another_cleaner_matf.exe has been seen being distributed by the following 31 URLs.

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wKHCFU50UC1UV49G0JJ0KC2K&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wQLDVK1GM48FHBBG0D3TLF80&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=w53OGL58EPOB259GG9T4R2MA&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wPNSDG4AUTOM6OBG0J85NJD2&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=w6NJR4KUPLQV3O9G08EFT7RM&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://www.yac.mx/download/.../down.php?pt=kwo

http://dl2.yac.mx/download/.../yet_another_cleaner_marb.exe

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wHESUGCELT6JS0AGG4JVQQ60&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://dl2.yac.mx/download/.../yet_another_cleaner_avac.exe

http://dl2.yac.mx/download/.../yet_another_cleaner_ymb.exe

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wIP5H9TVQGBCAFBG06318DFM&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wULABH5HKS9DUHDG0MB5C7AM&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://www.yac.mx/download/.../down.php?pt=mma

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wIDGCITMCQGSLM9G05RV970C&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=wR3GQHU2GU9H21CG0S2EDR9I&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://www.yac.mx/download/.../down.php?pt=vel

http://www.yac.mx/download/.../down.php?pt=sim

http://s2s.yac.mx/ads/adsavess?sid=yac&ptid=marb&subid=w6I4EQAIKGSEKTBG0UM75U4N&lplink=http://www.yac.mx/download/.../down.php?pt=marb

http://dl2.yac.mx/download/.../yet_another_cleaner_rkla.exe

http://dl2.yac.mx/download/.../yet_another_cleaner_avae.exe

http://dl2.yac.mx/download/.../yet_another_cleaner_reh.exe

http://dl2.yac.mx/download/.../yet_another_cleaner_aed.exe

http://www.yac.mx/download/.../down.php?pt=aed

http://dl2.yac.mx/download/.../yet_another_cleaner_ava.exe

http://www.yac.mx/download/.../down.php?pt=avac

http://www.yac.mx/download/.../down.php?pt=reh

http://www.yac.mx/download/.../down.php?pt=ava

http://www.yac.mx/download/.../down.php?pt=rkla

http://www.yac.mx/download/.../down.php?pt=ymb

http://www.yac.mx/download/.../down.php?pt=bbs

Latest 30 of 31 download URLs

Remove yet_another_cleaner_matf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.