yet_another_cleaner_sk_97862.exe

Setup

Elex do Brasil Participações Ltda

The executable yet_another_cleaner_sk_97862.exe has been detected as potentially unwanted by 1 anti-virus scanner. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Elex do Brasil Participações Ltda  (signed and verified)

Product:
Setup

Version:
1.0.199.30121

MD5:
39caa7c6326dcf36c6f9422c8bb17fa2

SHA-1:
27ae1bf23e2a217f9bcc8788e2a37600a69812f4

SHA-256:
dc25f68e013931440221ed311242581ca9620039bc1a24736f8b2b15cba39bc2

Scanner detections:
1 / 68

Status:
Potentially Unwanted

Analysis date:
12/25/2024 5:44:25 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic.ELEX.Installer.Meta
15.12.18.10

File size:
898.1 KB (919,656 bytes)

Product version:
1.0.199.30121

Copyright:
Copyright (c) 2011-2015 Elex do Brasil Participações Ltda

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\yet_another_cleaner_sk_97862.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
4/13/2015 2:00:00 AM

Valid to:
7/13/2017 1:59:59 AM

Subject:
CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Sao Paulo, S=Consolacao, C=BR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0671EE526ACB6F9BE201F5A8E203C41C

File PE Metadata
Compilation timestamp:
12/18/2015 8:43:12 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:CZqxP0agXFNY9IvgcC/R/v7BxPlpJsBCk:w40aoFpAxLJI5

Entry address:
0xABFA

Entry point:
E8, FE, 47, 00, 00, E9, 7F, FE, FF, FF, E8, E7, 22, 00, 00, 85, C0, 75, 06, B8, 34, E9, 41, 00, C3, 83, C0, 0C, C3, 55, 8B, EC, 56, E8, E4, FF, FF, FF, 8B, 4D, 08, 51, 89, 08, E8, 20, 00, 00, 00, 59, 8B, F0, E8, 05, 00, 00, 00, 89, 30, 5E, 5D, C3, E8, B3, 22, 00, 00, 85, C0, 75, 06, B8, 30, E9, 41, 00, C3, 83, C0, 08, C3, 55, 8B, EC, 8B, 4D, 08, 33, C0, 3B, 0C, C5, C8, E7, 41, 00, 74, 27, 40, 83, F8, 2D, 72, F1, 8D, 41, ED, 83, F8, 11, 77, 05, 6A, 0D, 58, 5D, C3, 8D, 81, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8...
 
[+]

Code size:
87 KB (89,088 bytes)

The file yet_another_cleaner_sk_97862.exe has been seen being distributed by the following 11 URLs.

http://dw.uptodown.com/dwn/67-7NR-FxE5ojqAJlR8UUW03vpb6QPX-9Fz7dCBwkkMnRFeZ57P3mEDLeheUbz2vINOLjfDfGC08coJK6XMGCdY9jhQLpKQYsOVUbDXgoo_h9-lo93u4Xlu3doAPHLN3/io0aJARFcz3NbCVBDAnh-cLU-egrFJOFnpHh2z7lbdMrt1xiSYgzItoW8LSbQsSaqfdCTwbJ2Kobbu0E9E-otSF65sfipU8N5O7n-KQzLpBaFEb8vKnMQdeJ4znEnXF4/oMDzFV4K7InUmcxhz4nOTdFLvZZvloJdss4hS5OlwIPYKVDNvv2Lye88bz0SU4hUqKqTkK-tG27F3KD01lgY9fNzp4qTk-lPA2ESIEw5584OwjUfqY8ouLZuQ6RQouiS/.../

http://dw.uptodown.com/dwn/Btq79SClpoqYpBziUyayb1B4hBgezAPLcZZIvfbH8TkoLgZYc3I-2ZN8HBgaTm41HcgKiXH6809k_EVDAlyxCqA9LVqLqHkOXbUBCJC_dVWaN3X1QuvH5ED8sm_9vOH4/UueAtUkC4kpkipV2x2qJvzCZj9pch6R1JAMFbb2_xQQKqO3eDSft2sLMkvjFQkc-E2IghjCIU3HE4TT8En_vY_9O5fM1JQgPxK_TPt9he-RpgFFpGqlNZedAz0gJuoto/2-CSa-VIE1i1vIkepL-j1WIhucxCSTGctgnX2KYzmxU5onD8XE3PFAeht1Fvz5jQnwltXvdMAHYQQGj1lFw2hg7CBQzYJb0qBA_iO6gemGyPjU3kFZpX8dzqHAn1S-0f/.../

http://dw.uptodown.com/dwn/J335ATJ7Q0W9vr7ZHqq5B9ZN-HAZarQgFg3y69sQNzYoZvUHV28q38MLH-Supr8jRM1yfecP0M5FNOPkbp9ITTBlbucCMlfQAYmaJ66TyE-6ng7KUsoLCoQPESh4yF9Q/49h2hTDUmraKYOe9j_foMFkbD6XUigcgkatyr7isEIlm_8muNMpPNaeONoZPzDPxHt_oNZ_Qjiopg1AKNYaZLSluqrAmvQC2Uc95XEbHUqv443qPbLUuEzjaZtyV1DT_/.../

http://dw.uptodown.com/dwn/zq-sZbb61w-zsx7VLwK41hGsA5J8u6fo6wwlKRexTGs7ikzVQBCs2Y1iiobO9C6yAOCcGr5gamwD77K4zJszpuIft8DOMTjVERdyrix2tOCDe4UVJ94-Y3HnCBWrpMlX/5ejiMG5PL-qG2sAuJbEfHHCTVDMsfhqNUocCSY8xnnCxA94m1Ow5hTVCpFeo0wDi_qj-UcUNeUVgI1W9DPCTCvdlpN95DbRl1N8uPF69xn1kK4LauXnNvT-kvgznrNx9/DT8jUPUNJM95uLNVXUya-arhyTGb2WUolWeKS111CpT-sNGF2JcG5UIrYu8uO6WV4N1UHGOJGIjjF4KzDgLCVN-9qYezoxVg7m5tS6wPFe0bxEmLXzaKltjrVD4bpKra/.../

http://www.yac.mx/.../7279498

http://dw12.uptodown.com/dwn/vMC2YV3sAwuy_DdRsak1KQqO2zhIx_2nCDIcikqCrY_eYiEW64IJs_FE3IZzm92l8jEKpcAaCgJbMvFthru0mjCR1FpELPmRD6IBEHWC4GyU0r-mFq-Gax1CiIKd0bk3/r3hZB2Cj2KmpIFAC0cTTHueuHqecmsdVmjbsAsEClxeib_L2uSGFbBRO9ZoTmdfpQFqoiOH78zkiJmdtFEMUU9hkBX3PMekfvjotrXWlaeF9iyBRsH2LWHlbwjbMvbUp/Y_ExLuOK8Abz9QBysNSksAeuIw0CoJ7U4txaqIbCp3ylf9PbhMMgBnLGJfUvaplD13S75wqMfDSYJ8RqxAqT138x3k0d5mVFAVc-v8V50zAhIJW0OSKUXSbZB8e20GUG/.../yet-another-cleaner-6-7-136-multi-win.exe

Remove yet_another_cleaner_sk_97862.exe - Powered by Reason Core Security