home

ytdinstaller.exe

YTD Video Downloader

GreenTree Applications srl

The application ytdinstaller.exe by GreenTree Applications srl has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from ytd-video-downloader-3.ar.softonic.com and multiple other hosts. While running, it connects to the Internet address hosted-by.leaseweb.com on port 80 using the HTTP protocol.
Publisher:
GreenTree Applications srl  (signed and verified)

Product:
YTD Video Downloader

Version:
4.9.1

MD5:
7b7e2a9914a808e46d5d482d23aebd8f

SHA-1:
97a3281c4a7cfaaa067e2eb5185e3fe2799b7d3a

SHA-256:
32bdc214b2020cf6186b4393e1860c951a343ba98ce1ccf59c35731b8f163af7

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 12:45:44 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.HfsAdware
1.3.0.7133

Dr.Web
Adware.Downware.10873
9.0.1.0233

Reason Heuristics
Win32.Generic.GreenTreeApplicationssrl.Installer.Meta
15.8.21.9

File size:
9.7 MB (10,178,384 bytes)

Product version:
4.9.1.0.1

Copyright:
Copyright © 2007-2015 GreenTree Applications SRL

Original file name:
Uninstall.exe

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ytdinstaller.exe

Digital Signature
Signed by:
GreenTree Applications srl

Authority:
Starfield Technologies, Inc.

Valid from:
2/17/2015 2:55:38 PM

Valid to:
11/18/2015 3:32:14 PM

Subject:
CN=GreenTree Applications srl, O=GreenTree Applications srl, L=Bucuresti, C=RO

Issuer:
CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00C427DA8891A2EF29

File PE Metadata
Compilation timestamp:
2/24/2012 7:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
196608:M/bEVMoRW8MNZ1vtu4o2OvJwcKGJT9DESeACbpbMOrny41ShOo:MMWdNvv84MvWc3TteA8uOry41SAo

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.9992

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file ytdinstaller.exe has been seen being distributed by the following 21 URLs.

http://ytd-video-downloader-3.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKCKpp2hlJQ=

http://ytd-video-downloader-3.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKONp6CokZc=

https://doc-10-48-docs.googleusercontent.com/docs/securesc/4oi8182jeoicj1o788hflgnavabd6c8j/2iif4u9mhohi7mk25eqmvnr62n0t1ka5/1446084000000/17117072084692606105/.../0Bx53E5MHxC2FMmF4RWFXQ05sdXM?e=download

http://ytd-video-downloader-3.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmJ-IpKWglp0=

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=6601

https://docs.google.com/a/.../uc?authuser=0&id=0B7bEjD5u9r2EM0RwMmtiaVVwY3M&export=download

http://dl3.vessoft.com/files2/y/ytd_windows/4.9.0.3/.../YTDInstaller.exe

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=9907

https://docs.google.com/a/.../uc?authuser=0&id=0B6Y37HSbtJB8NWlkaHFRcDRvZWs&export=download

http://l.facebook.com/l.php?u=http://catshare.net/.../YTDInstaller.exe&h=NAQGEFFc-&s=1

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=8146

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=20309

http://global-shared-files-lw.softonic.com/97a/328/.../YTDInstaller.exe

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=23414

http://up.bav.baidu.com/?rh=CB78C63287E977ACAC69559D65386F1D&baidusign=23616340&baidurand=27046

http://www.chucklepresentcycle.com/WVl6OTRQVTVLZWtSb1VrZzNabk5ZZFhCR05YZDZUelJZVVhkcE5uZzFZMVJ0V1VZeFJWTlNWVkJ1Wm05VU9GVWxNMFFtWXowMFRUQnFXbVZCV1dwa00wZDFNV0U0ZW5OWlkzSXlWRk5hVFRSc1JqTmFTVXhWTWt0TmRtNWFTblJZY3pRNE16Qklhek5tWjJ0bGVuZFlPSEZEWjFZMWMyTlNkMGxwTWpaT2NHa2xNa1oxU3poU1VucG1jRFF3YUcxbGVYbHRhVVJrZERFNFNtWnJkaVV5UWxWUVdUa3djbVZyY1VGakpUSkNNRmt5SlRKQ0pUSkdXVFJUUW1RMWFIWnVPSE5NY21oYVMwOW9WMjA1UzBvM1YyMDROeVV5UWxFbE0wUWxNMFFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprTXpnM05tWndkWG8xWkdkc2F5NWpiRzkxWkdaeWIyNTBMbTVsZENVeVpsbFVSRWx1YzNSaGJHeGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MVpWRVF0Vm1sa1pXOHRSRzkzYm14dllXUmxjaTB5TnpnNU5pMWtjQzVsZUdVPQ==

http://www.downloaddoo.com/Download.aspx?ProgramId=5403&Seq=1

http://d3876fpuz5dglk.cloudfront.net/YTDInstaller.exe

http://dl3.vessoft.com/files2/y/ytd_windows/4.9.1/.../YTDInstaller.exe

http://software.thaiware.com/download_url.php?id=10634

http://gsf-cf.softonic.com/97a/328/.../YTDInstaller.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to hosted-by.leaseweb.com  (95.211.187.107:80)

Remove ytdinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.