home

yet_another_cleaner_reh.exe

YAC Security Protection

Elex do Brasil Participações Ltda

The application yet_another_cleaner_reh.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.yac.mx and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
Setup

Version:
4.4.34.12158

MD5:
7aa011d6ee65ac6d87ab1bc2496318fc

SHA-1:
9ebd388e787acb52a78b4a81caf78310bf18408f

SHA-256:
95aad80c03530cccc8594856a76359d29bebd0009193b36cb71a29b54301991d

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 7:26:32 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.ELEX
4.0.3.14619

Reason Heuristics
PUP.Optional.Installer.X
14.6.19.12

File size:
707.2 KB (724,152 bytes)

Product version:
4.4.34.12158

Copyright:
Copyright (c) 2011-2014 Elex do Brasil Participações Ltda

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_reh.exe

Digital Signature
Signed by:
Elex do Brasil Participações Ltda

Authority:
GlobalSign nv-sa

Valid from:
9/24/2013 6:46:21 AM

Valid to:
8/17/2014 9:28:53 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F51916F2BB9F54E82871FEA88CE8F5E

File PE Metadata
Compilation timestamp:
6/17/2014 9:00:11 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:G715o8r/FA5UDRuCHJ2ssHQlnsmrJgDnJ/UXoXAoCwOOg3cS:GZVr/FA5UDIC08smrSDJ/UXXoCwOL3V

Entry address:
0xC2D2

Entry point:
E8, 3F, 3A, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, BC, F6, 41, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 38, E2, 41, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, BC, F6, 41, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01, 00, 00, F7, C6...
 
[+]

Code size:
88 KB (90,112 bytes)

The file yet_another_cleaner_reh.exe has been seen being distributed by the following 39 URLs.

http://www.yac.mx/download/.../down.php?pt=ava

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=vP76ZtRlPrc6c15rjMXJexfKPcpG6HlPBUw8A9NNvGLJCXrC3tU8xgfWPgtYtmhv8Ffrp2CzUZ3Uyo-FHlrhniTMNfEu0dSCK4KAU_lWZrwVWnTuFn3rM3NCbPzu-_tFSRU0y0syWl_6mVYgIxIEl-6WPpeTnaN4MeqHQ_7VjHDv7fCRHZBAYp0jbei5FbH6efgbZroirOfHYg8f_6rpQykcWaqPfV_GWvUcBhyWrV7WgmHfbnROjmBPLiFHXs5II5rsAU0fJ_GsPkJMtInGZWIUOS9J383iz3XT7tRBbIMR_M00N2yJMRBC0b1GHb2shVvgOqC8_WB-t2-8GgnltLDOl9qmCFqlLunYQxSDJtis-7OVjZEMKbdJjdIRSzOpzccQhanEOxPHm5hCLc9BDBaJy7FT3WhS-FTn28vqQRE7i_7WkCrh8JoK_Y7L0rqJkAmnPdXQTj1XCtXnggs&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=HnwDGVUOsVCrcrUJE5UhsjcoK0v9qfod--bYawmzVtVURBjpdic_MtptB4Cq-W5X3YrgQHg93AwnJZvQzQ9g7nVOG9Zyq5eFvZ3A5N5di9zkdW3HGU75NKVLnZgJ2yINQ5_tNzgWo670E8oiTkLJpPfNipIE82EhNoFzl1xKkYfRaz_cPNnaKc-H_-FvxZkUMZaY9dbrlXOEUsmaZsrpZ4uSNiP8iJgn3ZLiBYiqtVBOkUbaah2KmD55cz3_iR4XbXVzomYOFSSltJsKI61GEB5RPSR99kQxPEcLtF6wueK6-fsVGMmI_nXkyhKv0p_03b0JtSMdqavn9xXUtxcDhzk3dNSKxoq94T3UX_XvYXb-YckOJ9uhOYXTdcYz4jC7gh642qMttxZtiU9F-4eWDYxyHRIrnUxse3Zx98hbcZuHlR1Az7WZ7H8KhDvKMsTs1UKqt_a3qM4mGwP5sPU&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=brob

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=suhUyfuS5mWRgMsuC4Q3G5XSqESvs5lOXi-BrvyYyvlnp_IsoV5COJ3Hhje3SUl9bwmIcYCXqH01G531qmtCrzDh9rZws3-QmVoqi89SzMDjD98WUBDetNclfbScsPDmLlVlcvz-vdv50jSldU8iMOUgUPnuGPA-4MlP2W-XSnIt2-RDxAe37m3l6AerCjIZa1Lhh6jQ2QLfoqBobLM2D7OH8U_TUu3unmex2WEuweeygn2u0xnQMlp-XABeZ30ACunNkGt81l7TqFSBQ5nmyMPensB1RYSijIxupRAs_CJUcmbF_SUaXheiajjsCC1NYvZcP48n-Scc7sOdQ_yx8bHnDekvgJ9YWURDn0AenliiDE7rHYpv6mC9NEkIU2nvl8Y-cLz8NBPQp7K5iXuq_nePDNzLw8l63CFmMu5F--vrID9pqEgcJpcDdslNG33iwfR6EDliRdQiKkdNm-w&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://lax1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAFK4HoXrUeg_AAAAAAAAAAAAAAAAAAAAAJaXCO-69oFIysR6Kz8YlCMywaFTAAAAAOXJLQB6AgAAdgIAAAIAAABxbPoAocQGAAAAAQBVU0QAVVNEANgCWgAZ7wAAcK0AAgUAAQIAAJAAtRmAkwAAAAA./cnd=!xAZtQgjlmvQBEPHY6QcYoYkbIAE./referrer=http://www.daftertv.com/television-en-vivo/ver-tdn-en-vivo-online-gratis.php/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=lax1CMqJ69vyh4bKIxACGJavoviu1_3ASCIOMTg3LjIwNi42Ny4xNjAoATCygoedBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=tD2q1i-XouCUWP21h1ryx0RF6wmWxla6fEX3A2qLHFQKIDBm27F1olwpCeb1IFzTHb9bB2-_8MuwRsAVCZv1pCepm3NCIIBYfzTDDQDNdDUmMabyUX-o_JwnmPBCAOie_5ShNGWsvPJw1F65xpWzN5O7Yfot2PgEQiit1e-pWEE9K6wr1PACrHXUOMgxXTyk-WA7SqNE-FOEcAJFsfnTCF4OpKYYzWPKtPCWVa_UeX-cEF5GLsoNbHLTHLhtuHfoy24QTL2s0e5J0Z7SnUoDhy1NV7-gDXe17FWPfiXgO2AvD-IFC5GR5KvE83E8XQuux8KofVCtL43T3fHOV9XWpaPjWu8pKC4D1pFhxDDPb6i3mtyalYKIX2a2BMTDLuXfJUhRNZMIXigqEuURaB1BeVrtf3ePC-F3qS-vDa3D6t-rszEbvrYGbDiGzrqSJhJ0jJdQyQM&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=fvsR4tMF28CNWpSvTfMJ0p7BDSAWm7XkGh2ovg1I_PFTdxEbJh5vZnc7HtxF0XHWBvR1zeKWPGNBtRZgcngvzr-410LDjx023DUGRvWawVrBLKOqpXaE_2XASes_Em_wo36tM0yuWFiI5pfZzhmMDXRCiEiV6LzpZljxJtkboO_ckXiwt3vSPw580GyuNM9-3IN9HENxQsRVQ__RLvK0EadUceNpK8U6yqxKhx1AL5sfwMtdcngzfr3L1CNP0-PGdxiAfDLprx4CYcETy8MHcyR__a7yNjF1yvssDhVZ2wZKjhQQMTz-JXLE57TOM2STii3OtVEXWEKf9kr8TOLCB-ve9nt7tU0iesB2UdZChyGFrte-KFzydKwYDA-ArknWBqTye2ysu4XYHK9yRZOXarCo3GrJ29IR-wG5k_7kI0A3h510izW-nHZZcpHKbKsQYuKlZykNRQ&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=S2x-5MBAEdG5Ak_XHj4DNlTZEwbEJAwUG_N4izcL87dDdLIjRGWkmI1azcWv-O-LUa4549XxoVTIia2MwQJVJai-TOtzVLuIHZJ8u8zYAF70ylRTO8CdjVL19WQPVwsJn4CG8sHMTY1WBEJllsgGqGsh0ShFY_0td0VVKRBC32OPksXtvuUPM7KpfIDqAlch80vH6iPlyKLbWRMEWoMgdFHuzkZY-nvCTIEADgSEGKgJD8UmgLhXn6vkrEwodvDTuqyp4biPuvgnxGl09p2d_J_zCQG_QNbbwRKJhnbgB2eh667Dr0x2YOcUkFxDjHPY5IdHwqg-d4U3TKATjoRRhVm5HXZ8t4GQqL9r8PC3z9Ue0EO7NTlyYNW_bNAbLPGnAB-JXU8BMTLymJDKVJOX68OiX8ex-1hg9NPVwFwv_dTAVCpSPnm5OF_A1AgeAg6QuQ5jaHt6A5oJwQ&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://lax1.ib.adnxs.com/click?_AWWwF8Ytj_Xd6ebsB-xP0a28_3UeOU_13enm7AfsT_9BZbAXxi2P7qknzfsH0JkkyBetJj4vC6Vz6BTAAAAAF4TLQBaCQAAdgIAAAIAAADDBvkAT60GAAAAAQBVU0QAVVNEACwB-gCe4gAAOZEAAQUAAQIAAJAAHyqpxgAAAAA./cnd=!yQZIQAjqmvQBEMON5AcYz9oaIAE./referrer=http://lesoleildelanuit.com/player-sportlive3.html/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=lax1CJPB-KKLk77eLhACGLrJ_rzD_YehZCINMTg5LjE1OS4wLjEwNCgBMJWfg50F&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://fra1.ib.adnxs.com/click?l5XpQLNNjD8Kt2Vh7n2HPyGwcmiR7cw_CrdlYe59hz-WlelAs02MP6n7P17Zr_dMru6G3-rEo2NsnqBTAAAAAMDoKQCTBwAAdgIAAAIAAADQ6OYA4n0GAAAAAQBVU0QAVVNEACwB-gBbVgAAGMwAAgUAAQIAAJAAuSzISQAAAAA./cnd=!2wZsPwjBm_QBENDRmwcY4vsZIAA./referrer=http://tvnwarszawa.tvn24.pl/informacje,news,diabel-w-warszawie-br-zobacz-trailer-filmu-kick,126044.html/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=fra1CK7dm_ytnfHRYxACGKn3__GV--v7TCINNzkuMTg1LjE5Ny4zOSgBMOy8gp0F&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://www.yac.mx/download/.../down.php?pt=mar

http://www.yac.mx/download/.../down.php?pt=mmac

http://www.yac.mx/download/.../down.php?pt=kwo

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=HN6jAq7JBKRdRw1l7EGNmY6JAjuIL3yKCakFwE1iE1GH5hyPoMLIkm8uoQLswD9B153nvMo9c8oK4oykbHC89A9rHp4nx-QQ_cBLExB7xwYr5p2f-lcxvRq4ppad_c7E9GiOmWzz6eJxNy8JIa881pUHTKQuiRs2HtfICo-uLUIvHbITbM2cMIw5Fuoxzh_cA9ZnBHwjCJaNvIKgO7HtA1Bm_AZO3S8h3c1AllwmsiDaPbI2LBbLP6t2_tlgEEo8-7-WOgQ3NbR4G03xNcapFb4GKOHye9Y1hmrdxNYq2_0jYkiodWov09e5-BxFt7sg81Mxj_09skCu5nvoYKUxdIJphjG9FPijMZTSeGqUej3ZS-9Bfzqa42xDbzy4mMn2E3VfSSHnHHgPSlPaAvqdvnRUsujOMGAJUR3kJioCrwQ8pN7qldgE2OmLGQx3Vcc4qJTO&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=mma

http://www.yac.mx/download/.../down.php?pt=a4g

http://lax1.ib.adnxs.com/click?joc1UgILxD-OhzVSAgvEP2iR7Xw_NeY_joc1UgILxD-OhzVSAgvEPwtoJYzvCCBGmih26pln6i0nJqJTAAAAAC9nLQB2AgAAdgIAAAIAAADDBvkAJLYGAAAAAQBVU0QAVVNEACwB-gDB2AAAK9wAAgQAAQIAAJAAOCE8JQAAAAA./cnd=!uAYVQAjwmvQBEMON5AcYpOwaIAM./referrer=http://www.lanacion.com.ar/1702423-por-que-el-rey-felipe-vi-de-espana-no-sera-coronado/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=lax1CJrR2NOe85n1LRACGIvQleH4nYKQRiIOMTg5LjE4MC44My4xMTgoATCnzIidBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://www.yac.mx/download/.../down.php?pt=mcr

http://dl_151.yac.mx/download/.../yet_another_cleaner_dnp.exe

http://www.yac.mx/download/.../down.php?pt=bro

http://dl_151.yac.mx/download/.../yet_another_cleaner_mma.exe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=pRyXnxrwicqungPQ2MFmWIuRt6FrCCG7VgOG7T9FgGkPa5jBRMZmRQd2RdB8VMBHh839fDDIvIciOX1cQIx94Z6yE0LegeuYGQAkW9X5kgChir9W5S5yZN-dmGP8hmrDsZeGZtcML8wTRIDy9Yefnh_G5RdRH5liT0ES0SxQ_fAt4Aj_U7NNyerWrBv4zMgUP8a8gvIbi1HjI6DpsIpHGgezXp5pYGawn2oJ-cnxd5WB5JlDPjAAfGiohM5qDr-LsGHT-O2cLGTpwYcFF-aWQK2KitWkSSRvk41Ye4MY0-b3xXHSpYBfC63GQOQJUCO8Z5Gm-77ZZgLz7EluZCaJe8q63m4dIvxrowYQl9KS2f9xaReWuInXL_PXmKAJzD9_bbiMr00jpYt1U7GUUGZkeuL-KLqX8HXuoVbRx29MdX0tSAslJ7jv86ymCZDZ8qI3oEeLcgMRjSTTTVBiUxE&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://dl_150.yac.mx/download/.../yet_another_cleaner_broe.exe

http://www.yac.mx/download/.../down.php?pt=broe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=fra1COWk5I7s8rGFNRACGJ2Bg7efvoW_LiIMNzkuMTE3LjQ0LjY0KAEwpO-AnQU.&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://fra1.ib.adnxs.com/click?JsEcewP9wz9kTpUMH5fAP23n-6nx0s0_ZE6VDB-XwD8mwRx7A_3DP53A4PbxFX4uZRLZwZbHCjWkN6BTAAAAAMXoKQCTBwAAdgIAAAIAAADyBegA4n0GAAAAAQBVU0QAVVNEACwB-gBcVgAAFMsAAgUAAQIAAJAAkSgc_wAAAAA./cnd=!lgY4PAibm_QBEPKLoAcY4vsZIAA./referrer=http://get.adobe.com/ro/reader//clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=fra1COWk5I7s8rGFNRACGJ2Bg7efvoW_LiIMNzkuMTE3LjQ0LjY0KAEwpO-AnQU.&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://dl_149.yac.mx/download/.../yet_another_cleaner_reh.exe

http://dl_150.yac.mx/download/.../yet_another_cleaner_dne.exe

http://dl_149.yac.mx/download/.../yet_another_cleaner_dne.exe

Latest 30 of 39 download URLs

Remove yet_another_cleaner_reh.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.