home

YourFileDownloaderInstaller.exe

YourFileDownloader Installer

Ironnuts LLC

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file YourFileDownloaderInstaller.exe by Ironnuts has been detected as a potentially unwanted program by 20 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dll513.yourfaild.net.
Publisher:
http://yourfile-downloader.com  (signed by Ironnuts LLC)

Product:
YourFileDownloader Installer

Version:
1, 0, 685, 1

MD5:
5ec0a12af029a165113d800180f3780d

SHA-1:
4754ccafeb36a70d5e9c596a70bb55e78293437f

SHA-256:
f5bc627868e68770952d22eb759a233f24112ff57ec579f696eed7ea73ca1378

Scanner detections:
20 / 68

Status:
Potentially unwanted

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/25/2024 12:25:14 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.14525543
5512208

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.YourFileDownloader
2015.05.19

Avira AntiVirus
PUA/EDownloader.Gen
8.3.1.6

avast!
Win32:Dropper-gen [Drp]
150423-1

AVG
Adware BundleApp_r.AX
2014.0.4311

Bitdefender
Trojan.Generic.14525543
1.0.20.695

Bkav FE
HW32.Packed
1.3.0.6379

Clam AntiVirus
Win.Trojan.14525543
0.98/20482

Comodo Security
Virus.Win32.Virut.CE
22170

Emsisoft Anti-Malware
Trojan.Generic.14525543
10.0.0.5366

ESET NOD32
Win32/ExpressDownloader.N potentially unwanted application
7.0.302.0

F-Secure
Trojan.Generic.14525543
5.13.68

G Data
Trojan.Generic.14525543
15.5.25

K7 AntiVirus
Adware
13.204.15949

Malwarebytes
PUP.Optional.Downloader
v2015.05.19.05

MicroWorld eScan
Trojan.Generic.14525543
16.0.0.417

nProtect
Trojan.Generic.14525543
15.05.18.01

Reason Heuristics
PUP.Via Advertising.Bundler
15.5.19.4

VIPRE Antivirus
Threat.4150696
39676

File size:
4.5 MB (4,679,632 bytes)

Product version:
1.0.0.1

Copyright:
Copyright http://yourfile-downloader.com (C) 2014

Original file name:
YourFileDownloaderInstaller.exe

Bundler/Installer:
YourFile Downloader

Language:
English

Common path:
C:\users\{user}\appdata\local\temp\lqf7c8g2lk.tmp

Digital Signature
Signed by:
Ironnuts LLC

Authority:
Ironnuts LLC

Valid from:
5/12/2015 4:13:26 PM

Valid to:
5/11/2016 4:13:26 PM

Subject:
CN=Ironnuts LLC, OU=Ironnuts LLC, O=Ironnuts LLC, S=London, C=UK

Issuer:
CN=Ironnuts LLC, C=UK, S=London, L=London, E=admin@ironnuts.com, OU=Ironnuts LLC, O=Ironnuts LLC

Serial number:
100001

File PE Metadata
Compilation timestamp:
5/5/2015 10:27:24 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:Rof/k+FPMLN+Wbul622pJuNanW68O7uKo0UiQPQbr6e3GRVdbvCM:RSkwPMLN+WbO3NyWo7uKo0UiQobrrgVD

Entry address:
0x8FC7A9

Entry point:
50, E8, 45, 17, 00, 00, A3, 20, 08, 0B, 33, 62, 42, B7, 42, A3, DA, 3B, 72, E7, D6, 89, 74, F8, E7, 8A, C1, 1E, 55, AA, 95, 45, 7C, FD, E8, 94, F8, AD, 98, 3C, DE, FE, 63, 1B, F3, D9, F4, 4B, 2F, B7, A2, 2A, C3, 03, EB, A0, 87, 02, AD, 39, AA, 7F, 8C, 50, 28, 81, B8, 09, 63, 6E, 06, C3, C8, 6C, 2F, 85, 9D, DD, 7A, 1E, E8, 3E, 5A, EE, 20, 87, 23, 36, 7E, E6, DD, 65, 95, 0A, 64, 88, A1, C4, 45, 78, 47, DA, 34, 92, C7, 50, CE, 4D, F1, 2C, 91, 6C, 37, AD, 20, C6, C2, E5, 3C, 53, E6, FF, 9C, 02, 35, 96, 6F, D5...
 
[+]

Entropy:
7.9280  (probably packed)

Code size:
1.1 MB (1,187,328 bytes)

The file YourFileDownloaderInstaller.exe has been seen being distributed by the following URL.

http://dll513.yourfaild.net/j5GWWHferRBA279Yb5PmbT6XpiJgqbgnPa 4NmnjhjZw6pEkH HdaBfi22wS6cdFXamXDlbdyFsG08RfDs5xEkyYaxIwr2Afe8crCziZd Unn0rzK3B8tm4ifuMza0quaipR8xFPQfQVYBDrAn1Qxx1yUNNcQ1bGUFBZ3CVLLsYQWDfOv3wCnfRRLNPVWz2q7VcKqf19be3iIC6Q8zhc4q9 S aRZEfql2xD7p5sV5bPAx2GwQhE3tNRS4yNDeXEil 3lvpJsM nQryZqR6oNfpL9mbms6sto WgTJKuzXTj6csxgfHdJtKy3mqI8dV8jf3BGsCGyVmZwMhMjveoV8Oe40Vj3q0GN4f4Dj6epX55mr4ia/.../DUBjsl18C0w==

Remove YourFileDownloaderInstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.