» 76e1c458-a272-4ed5-9174-8ff47461df84.exe
Overview
Analysis
File Details
Downloads (2)

76e1c458-a272-4ed5-9174-8ff47461df84.exe

Id-Kphipmfozlj

BadFinger Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application 76e1c458-a272-4ed5-9174-8ff47461df84.exe by BadFinger Project (BrightCircle Investments Limited) has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

Kbblbztwqde & co. (signed by BadFinger Project (BrightCircle Investments Limited))

Product:

Id-Kphipmfozlj

Description:

Atmid

Version:

1.23.13.22

MD5:

cd48d08f2e535dbb6be275cc6d37c4e9

SHA-1:

84fc30b3d499ba8dfa2fa2d913da3a597dbd5d5a

SHA-256:

4e7941afe5b4101d02ccb0188a3b55cc4bf976f4c8d3ccec509375d1174c3af4

Scanner detections:

12 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

12/25/2024 4:35:03 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/CrossRider.Gen

7.11.193.172

avast!

Win32:Adware-gen [Adw]

2014.9-151030

AVG

Generic

2016.0.2941

Clam AntiVirus

Win.Trojan.Crossrider-36

0.98/21511

Dr.Web

Trojan.Crossrider.46579

9.0.1.0303

ESET NOD32

Win32/Toolbar.CrossRider.BM (variant)

9.10844

IKARUS anti.virus

PUA.ScrambleWrapper

t3scan.1.8.5.0

K7 AntiVirus

Trojan

13.186.14270

Malwarebytes

PUP.Optional.CrossRider.A

v2015.10.30.10

Qihoo 360 Security

HEUR/QVM20.1.Malware.Gen

1.0.0.1015

Reason Heuristics

Adware.BrightCircle.Kbblbztwqdeco.Installer (M)

15.10.30.10

Trend Micro House Call

Suspicious_GEN.F47V1205

7.2.303

File size:

11.3 MB (11,876,264 bytes)

Trademarks:

Kphipmfozlj is a trademark of Abifyttmsw

File type:

Executable application (Win32 EXE)

Installer:

Nullsoft Install System

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\76e1c458-a272-4ed5-9174-8ff47461df84.exe

Digital Signature

Signed by:

BadFinger Project (BrightCircle Investments Limited)

Authority:

COMODO CA Limited

Valid from:

11/17/2014 1:00:00 AM

Valid to:

11/18/2015 12:59:59 AM

Subject:

CN=BadFinger Project (BrightCircle Investments Limited), O=BadFinger Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6623FAFCAC357577A31D90C1E567E9A7

File PE Metadata

Compilation timestamp:

12/4/2012 2:55:11 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.22

CTPH (ssdeep):

196608:qeGxEmxKGTuM5FyMZhoHY+aNqENa9g5jRU8zUz6d0+/oVkQIm90LQTX:qeGxEo1iM5FNz4XlIRUgUG6+GiLQD

Entry address:

0x412D

Entry point:

55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, 73, 45, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, 74, 45, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, 74, 45, 00, 56, A3, F4, E7, 44, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8B, 3B, 00, 00, A3, 50, E8, 44, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, A9, B2, 40, 00, FF, 15, AC, 74, 45, 00, 83, EC, 14, C7, 44, 24, 04, AA, B2, 40, 00, C7... 
[+]

Code size:

33.5 KB (34,304 bytes)

The file 76e1c458-a272-4ed5-9174-8ff47461df84.exe has been seen being distributed by the following 2 URLs.

http://vzbucket.clara-labs.com/3c91fcc2-ce59-42b3-b901-f68079520898/build/.../76e1c458-a272-4ed5-9174-8ff47461df84.exe

http://vzbucket.clara-labs.com/3c91fcc2-ce59-42b3-b901-f68079520898/build/.../19bf20cf-bd4c-4710-a16d-f05b627514af.exe

Remove 76e1c458-a272-4ed5-9174-8ff47461df84.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.