home

60190.bubble_dock.bbd023.no.exe

Bubble Dock

NOSIBAY

The application 60190.bubble_dock.bbd023.no.exe, “Bubble Dock installer” by NOSIBAY has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cdn.bubbledock.co.uk and multiple other hosts.
Publisher:
NOSIBAY  (signed and verified)

Product:
Bubble Dock

Description:
Bubble Dock installer

Version:
3.0.641.0.60190

MD5:
c08c8285f5045261dfda6a0c25957d70

SHA-1:
a44377481a023607f3ad809620b3ec7318228b8a

SHA-256:
8e38ea0c0fdd587736943c98bea7c76baad514a165d89fee1e51b9f648967414

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
11/22/2024 8:33:14 PM UTC  (today)

Scan engine
Detection
Engine version

Malwarebytes
PUP.Optional.BubbleDock.A
v2014.02.16.11

Reason Heuristics
PUP.Installer.NOSIBAY.Y
14.2.16.11

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.24.3

VIPRE Antivirus
BubbleDock
26418

File size:
6.8 MB (7,150,616 bytes)

Copyright:
© Nosibay

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\60190.bubble_dock.bbd023.no.exe

Digital Signature
Signed by:
NOSIBAY

Authority:
Thawte, Inc.

Valid from:
9/21/2013 2:00:00 AM

Valid to:
11/21/2014 12:59:59 AM

Subject:
CN=NOSIBAY, OU=Nosibay Secure Developement, O=NOSIBAY, L=PEROLS, S=Hérault, C=FR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4F1CA396B891ED381AFEECC074DB8714

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:EP8vNssx0Tus8+RYSDUb+dmqsJ1QPAraSZK6/M2aBNoqw:B9js8+RYSXmq4aSAOvaB

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Code size:
23 KB (23,552 bytes)

The file 60190.bubble_dock.bbd023.no.exe has been seen being distributed by the following 3 URLs.

http://cdn.bubbledock.co.uk/cl/.../60190.Bubble_Dock.BBD023.no.exe

http://cdn.bubbledock.com/.../60190.Bubble_Dock.BBD023.no.exe

http://cdn.bubbledock.es/.../60190.Bubble_Dock.BBD023.no.exe

Remove 60190.bubble_dock.bbd023.no.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.