home

yet_another_cleaner_sk.exe

YAC Security Protection

Elex do Brasil Participações Ltda

The application yet_another_cleaner_sk.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 3 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from lax1.ib.adnxs.com and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
YAC Security Protection

Description:
Setup

Version:
4.7.25.11488

MD5:
6cf0a0a4bea6c7ee951f36399620535e

SHA-1:
21061a5251ac36d529afefcd7fb88a7617fb2620

SHA-256:
1adf609b6dfb5a10f1426f80248aafc1f3a58a2902b1a91034106317e53ef772

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:27:32 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/ELEX (variant)
8.9907

Reason Heuristics
PUP.Optional.Installer.W
14.6.7.4

Trend Micro House Call
TROJ_GEN.F47V0408
7.2.158

File size:
12.2 MB (12,787,704 bytes)

Product version:
4.7.25.11488

Copyright:
Copyright (c) 2011-2014 Elex do Brasil Participações Ltda

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\yet_another_cleaner_sk.exe

Digital Signature
Signed by:
Elex do Brasil Participações Ltda

Authority:
GlobalSign nv-sa

Valid from:
9/24/2013 7:46:21 AM

Valid to:
8/17/2014 10:28:53 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11215F51916F2BB9F54E82871FEA88CE8F5E

File PE Metadata
Compilation timestamp:
5/30/2014 2:50:44 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
196608:18mB5/eRhtqxs8BQrkN/tx77H1Fm2hcGnMBYVuLj6BM9nLjadrvf98GxJYng:imB5/eRDcrX1s2bMBWu3V3a1vf9TxJz

Entry address:
0x12F0D

Entry point:
E8, DA, 5A, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3...
 
[+]

Code size:
108.5 KB (111,104 bytes)

The file yet_another_cleaner_sk.exe has been seen being distributed by the following 33 URLs.

http://lax1.ib.adnxs.com/click?dxZkZ0F2pj-cxCCwcmihP5zEILByaKE_EhTSMSIArz8ET6APFgC0P80NXocmA_4vp7C4r__aYChUE5FTAAAAAP92FQByBwAAdgIAAAIAAAAok-8A8M4FAAAAAQBVU0QAVVNEANgCWgDVowAAir4AAgUAAQIAAIYA0yQ8OgAAAAA./cnd=!YQafPAi3rfQBEKimvgcY8J0XIAA./referrer=http://img.df-stream.net/df/iframe_4.html/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mman&subid=lax1CKfh4v3637awKBACGM2b-Lro5ID_LyINMTg2LjYuMTM3LjE3OSgBMNSmxJwF&lplink=http://www.yac.mx/download/config/down.php?pt=mman

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=avai&subid=5949085041&lplink=http://www.yac.mx/download/.../down.php?pt=avai

http://lax1.ib.adnxs.com/click?ehSuR-F6hD-4jQbwFkiAPwAAAAAAAOg_uI0G8BZIgD97FK5H4XqEP6dksn1jrzknX8EfIl3jjGqR4JBTAAAAAN5eKwB6AgAAdgIAAAIAAAAok-8AmogGAAAAAQBVU0QAVVNEANgCWgDSZQAADcIAAQUAAQIAAJAAjSNQ9wAAAAA./cnd=!AgbKOgi3rfQBEKimvgcYmpEaIAA./referrer=http://edant.clarin.com/suplementos/especiales/2002/05/20/l-388164.htm/clickenc=http://lax1.ib.adnxs.com/click?-35qvHSTaD8830-Nl25iPycxCKwcWuw_PN9PjZduYj_6fmq8dJNoP6vF_yKHt8QEX8EfIl3jjGqQ4JBTAAAAAPPyLAAyAwAA0ggAAAIAAABD4vIAwvUFAAAAAQBVU0QAVVNEANgCWgD3owAAEbsAAQUAAQIAAJAAAyqNHwAAAAA./cnd=!tQZIPgiMwPoBEMPEywcYwusXIAA./.../clickenc=http://nym1.ib.adnxs.com/click?_Knx0k1igD8Y7IZtizJ7P8UgsHJokeU_GOyGbYsyez_8qfHSTWKAP8qX5RFdHgYSbq5tP8-FI3-O4JBTAAAAACm9JgDDBwAAMgMAAAIAAAAFfu0A9ZEEAAAAAQBVU0QAVVNEANgCWgA2fwAAFakBAgUAAQIAAJAAyCeFEgAAAAA./cnd=%21ugZBQAiW-vEBEIX8tQcY9aMSIAA./referrer=http%3A%2F%2Fedant.clarin.com%2Fsuplementos%2Fe

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=avan&subid=5949118008&lplink=http://www.yac.mx/download/.../down.php?pt=avan

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=F8vGN7gxug0d7_PL1FGlv8NS2djYnBStaHba7sMdyGVcAr3uB2eNrxGDTokx9GCbHqQIsmWi-U6MFMjt5VMXRCUf57rNjhxjC9pa1gB56tc3vYIpAZI5xQFtVQXtufd7n5mielNtrT5awKDzqIFGFO-ooX8dDQ_X1gCVFk1nCQ0mK9blZtzOcuPb7kbX_JUPaEYY0mBCFvjmB0Z8C6KkGZ7-ffSssrpSCsbVbr1nDvmLjYtLzTa-RdTxqonFt2J3P69jASsCfBk6MRtUtz0Q4Qzd5rLxZBmHkmV3Itg6pj1TvvGpZaWQ_gFddFkjKQCaMUfRoRWd3bBKAQQRCkQr93aN_la8FyLedP7XOUGGdQRBQ1CQVxyMOHA60qNb0wtOlWbtE24thg&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://dl_148.yac.mx/download/.../yet_another_cleaner_mar.exe

http://www.yac.mx/download/.../down.php?pt=mmac

http://www.yac.mx/download/.../down.php?pt=mma

http://www.yac.mx/download/.../down.php?pt=mat

http://www.yac.mx/download/.../down.php?pt=glp

http://global-shared-files-l3.softonic.com/210/61a/.../file?nvb=20140606170939&nva=20140607051039&token=095e13ae01dfe2e8241e2&id_file=69665508&channel=WEB&instance=softonic_es&type=PROGRAM&fdh=yes&SD_used=0&filename=yet_another_cleaner_-sfto-.exe

http://www.yac.mx/download/.../down.php?pt=brob

http://lax1.ib.adnxs.com/click?04nV7jDxgT-DgzmCssh9P2IQWDm0yMY_g4M5grLIfT_UidXuMPGBP0JgkPv1-vwNbEtr2982P2EEvJBTAAAAAM6UJwCTBwAAdgIAAAIAAAAok-8AwS4GAAAAAQBVU0QAVVNEANgCWgAF3wAAP90AAQUAAQIAAI4AzioJAAAAAAA./cnd=!cwa3PAi3rfQBEKimvgcYwd0YIAA./referrer=http://widgets.xrosview.com/widgets/1.4.2/shared/toasters/iframeToasterLoader.htm?innerIfrSrc=http://ib.adnxs.com/tt&random=softonicmpvNS2172&ifrMngrJS=http://widgets.xrosview.com/widgets/1.4.2/logics/mntrApn/js/iframeManager.js?v=softonicmpvNS2172&prdct=softonicmpv&openbanners=true&logicName=152mediaToaster&eventPrefix=152mediaToaster&referrer=http://www.youtube.com/watch?v=w24A2eesrUA/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mman&subid=lax1COyWrdv9282fYRACGMLAwdzf3r7-DSIOMTg5LjEzOS45OC4xNjYoATCE-MKcBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=mman

http://dl_149.yac.mx/download/.../yet_another_cleaner_ava.exe

http://dl_151.yac.mx/download/.../yet_another_cleaner_avai.exe

http://www.yac.mx/download/.../down.php?pt=avai

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=avai&subid=5949232136&lplink=http://www.yac.mx/download/.../down.php?pt=avai

http://dl_151.yac.mx/download/.../yet_another_cleaner_ava.exe

http://dl_150.yac.mx/download/.../yet_another_cleaner_bro.exe

http://dl_150.yac.mx/download/.../yet_another_cleaner_dmga.exe

http://www.yac.mx/download/.../down.php?pt=dmga

http://www.yac.mx/download/.../down.php?pt=ava

http://www.yac.mx/download/.../down.php?pt=vel

http://www.yac.mx/download/.../down.php?pt=bro

http://dl_151.yac.mx/download/.../yet_another_cleaner_mar.exe

http://www.yac.mx/download/.../down.php?pt=mar

http://dl_150.yac.mx/download/.../yet_another_cleaner_reh.exe

http://dl_151.yac.mx/download/.../yet_another_cleaner_reh.exe

http://dl_149.yac.mx/download/.../yet_another_cleaner_reh.exe

http://www.yac.mx/download/.../down.php?pt=reh

Latest 30 of 33 download URLs

Remove yet_another_cleaner_sk.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.