home

YourFileDownloaderInstaller.exe

YourFileDownloader Installer

http://yourfile-downloader.com

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file YourFileDownloaderInstaller.exe has been detected as a potentially unwanted program by 11 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer, however the file is not signed with an authenticode signature from a trusted source. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dll513.yfiled.org and multiple other hosts.
Publisher:
http://yourfile-downloader.com

Product:
YourFileDownloader Installer

Version:
1, 0, 640, 1

MD5:
e39acddac11eebfc7a5c2f9326ab283d

SHA-1:
08ef00cbd389e8db2ebc1e754c8b3bcdfd0ee9dd

SHA-256:
d9d93c8ff9d6555b05eb551d223a120ec8655aa702d33c76011b192142915d95

Scanner detections:
11 / 68

Status:
Potentially unwanted

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 8:37:34 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.589566
666

AhnLab V3 Security
PUP/Win32.Downloader
2015.04.07

Bitdefender
Gen:Variant.Kazy.589566
1.0.20.495

Dr.Web
Adware.Downware.10806
9.0.1.099

Emsisoft Anti-Malware
Gen:Variant.Kazy.589566
8.15.04.09.06

ESET NOD32
Win32/ExpressDownloader.K potentially unwanted (variant)
9.11436

F-Secure
Gen:Variant.Kazy.589566
11.2015-09-04_5

G Data
Gen:Variant.Kazy.589566
15.4.25

herdProtect (fuzzy)
variant of برامج_تصميم_مطابخ_308040_downloader.exe (PUP)
2015.7.12.14

MicroWorld eScan
Gen:Variant.Kazy.589566
16.0.0.297

Reason Heuristics
PUP.Bundler.Via Advertising
15.4.9.14

File size:
3.8 MB (4,014,592 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

Bundler/Installer:
YourFile Downloader

Language:
anglešcina

Common path:
C:\users\{user}\appdata\local\temp\bw4fyx2ov9.tmp

File PE Metadata
Compilation timestamp:
4/7/2015 11:25:26 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:+uBfb+4RDoc2s1DPye+EC5leRNgB9sbvjiOoN0v9u+aYZv/vM4Ow+D/aX9z8bx/:+uhb+4Roe+xj6bvt9PTZHUVnDaa1/

Entry address:
0x8C99D

Entry point:
E8, CB, C7, 01, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 48, F4, 4E, 00, E8, 1D, E4, 00, 00, E8, 65, B2, 00, 00, 0F, B7, F0, 6A, 02, E8, 5E, C7, 01, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, A8, 1B, 01, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
801.5 KB (820,736 bytes)

The file YourFileDownloaderInstaller.exe has been seen being distributed by the following 3 URLs.

http://dll513.yfiled.org/j5GAWnLZu14r4KJLa9T8FG/O Bdzsq0ofun7O2n10Gcs9NFkGuLfbgCnmD1DvMxSHuzBUQfX3xtXlokBX5peGlrRNlE2gmgdIJ1uID6BYeZzxDPkPml64Gs1O/s e377MX9RqhZ4TPoCZ0P6HjZSzAM6QcMBf1rEA0pJ3QMVEf9YXiDW7m8q1 9XJuDkV2zzqEgxtM0pKfanfWjhqH5P4axiVOOQdhy6 TwMrMJlQ9vPZEDV01BB3I5dRNqCCbPL316wxftBsMj3Q7rG Bq3dq9B1k/07P42s q7bLv8nD7vqtVljfTceJLLxHvXqpdRj/LRGsOSgBPGgskSjY6qVoeR/.../9MyLfk=

http://dll513.your-fd.net/j5GGWGzerFhy3atGIfC N33MujM5kKskPYevLnmjynYsis4ER6KAOkr/pjpTv5QNBZqAC17LvQRBipEAW4wnB03RNENwyD1JdcY0TmyLZOEnmCi2YjAtsm41O/87elX9O356/gYtH70SZkz5DHFS/BplRcJPGR/IGk1exEcZZ8caXxrf7UM9hvFRL9PjVjqi6k97pP0tf7/yNwKs9T0Pp w1WIPqdhu xzgyvMYxEojxMhragkYNj8U7FJ HWrHBkF692fNFvdX3TL3ZvxnOa68P/Tq2sPsz5LKta7jrkibru5By0KHKftX3zHvSroZB2a/RH9TV2Ba17JtDnZWkXdjPpEM/.../vxFcH0sxeVdecCQvbZRAOjjRPc5U=

http://dll513.yfiled.org/j5GEWWPcplwt4qFMY5OCKmnStCs5gbcvPY2zKXW6jDJqpYo5CYCbNEWxnixDtpZIa76aCFnGjRgL1cldAtwzQQ/fMFExhWsSIsk8T3rNJbp42mXmIHR37iRbdOtnPAfnLG1D8Qtzdu8fZEiiWysXwAJ1VsxPER/fEldixxVbNY4JSSfb614i2uJHY9zlVXe36k8KpP01N7/kPWCN3m4Ttv8gOrTOOQqw ToC4pp BYfdAxyXj1FJ2JhWSd2UWrDFkF63weQF6KSuFf6X9x71Z/xJpTPm5vg55rWlP m4lyW8upZx06KZeIKmnHqOvsRC09/9AZ7HhE6Ygt5OjpXxFY7eqlN3071kb9DwDSzKsC1qgeR0JfT/.../sdw2e67UNhGz32NA4NVtSLuXARfrxFdXgcwKA9TODA KYw==

Remove YourFileDownloaderInstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.