» amznsearchprotect.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

amznsearchprotect.exe

Amazon Browser Settings

Browser Distribution Services Inc.

The executable amznsearchprotect.exe has been detected as malware by 1 anti-virus scanner. It runs as a scheduled task under the Windows Task Scheduler triggered daily at a specified time. Additionally, the file is typically installed by a number of programs including Amazon Assistant by Amazon and Amazon Search by Amazon.

File name:

Publisher:

Distromatic (signed by Browser Distribution Services Inc.)

Product:

Amazon Browser Settings

Version:

1.1.12.1327

MD5:

009f4764834bb02f15746968b3ff88da

SHA-1:

7da1ab12876e65157b685ed19efeaf8597055ff5

SHA-256:

01257791af9415813067bb42ca617908304502cb2d4c84ce2d160b2ca9f7a173

Scanner detections:

1 / 68

Status:

Malware

Analysis date:

11/5/2024 8:10:14 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP (M)

17.3.15.19

File size:

3.2 MB (3,337,256 bytes)

Product version:

3.0.3.1185-28fbb98b

Browser Distribution Services

Original file name:

distro-silent-installer.exe

File type:

Executable application (Win32 EXE)

Language:

English

Common path:

C:\Program Files\amazon browser settings\amznsearchprotect.exe

Digital Signature

Signed by:

Browser Distribution Services Inc.

Authority:

Symantec Corporation

Valid from:

12/18/2015 1:00:00 AM

Valid to:

12/18/2017 12:59:59 AM

Subject:

CN=Browser Distribution Services Inc., O=Browser Distribution Services Inc., L=Las Vegas, S=Nevada, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

0E7157187A3C9C51E5535C5D49605D0C

File PE Metadata

Compilation timestamp:

2/4/2016 3:55:40 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

14.0

Entry address:

0x3EBC50

Entry point:

60, BE, 00, 90, 6D, 00, 8D, BE, 00, 80, D2, FF, C7, 87, F0, 3C, 3E, 00, A4, 5D, 0E, AF, 57, EB, 11, 90, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46... 
[+]

Code size:

1.1 MB (1,126,400 bytes)

Scheduled Task

Task name:

DistromaticSearchProtect-hourly

Trigger:

Daily (Runs daily at 20:48)

Description:

Keeps browser search settings up to date and makes sure they are not changed by malware.

The file amznsearchprotect.exe has been discovered within the following programs.

Amazon Assistant by Amazon

www.amazon.com/gp/BIT/theamazonapp

About 8% of users remove it

Amazon Search by Amazon

About 2% of users remove it

Remove amznsearchprotect.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.