» APNNativeMsgHost.exe
Overview
Analysis
File Details
Programs (3)

APNNativeMsgHost.exe

APN Native Messaging Host

APN LLC

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application APNNativeMsgHost.exe by APN has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. Additionally, the file is typically installed by a number of programs including Ask Toolbar by APN LLC and Ask Shopping Toolbar by APN LLC, both potentially unwanted software.

File name:

Publisher:

APN LLC. (signed by APN LLC)

Product:

APN Native Messaging Host

Version:

1.0.0.335

MD5:

8a4fed42855a9ec0116dc4b6e94707ec

SHA-1:

e7ffbd7b2ded8c5fb8ce963b19c0e4e394cdacba

SHA-256:

7390ceaa6b21939c74bb17ec1f573778fd49cc032f6ddb88b4fa70ea6d041ed4

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

12/23/2024 11:08:58 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Ask (M)

17.3.11.20

File size:

152.5 KB (156,112 bytes)

Product version:

1.0.0.335

Original file name:

APNNativeMsgHost.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\askpartnernetwork\toolbar\orj-v7c\source\Program Files\askpartnernetwork\chromeutils\apnnativemsghost.exe

Digital Signature

Signed by:

APN LLC

Authority:

VeriSign, Inc.

Valid from:

1/22/2014 7:00:00 PM

Valid to:

4/8/2015 7:59:59 PM

Subject:

CN=APN LLC, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=APN LLC, L=Oakland, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

2F4E343161BC7EB67514D3DCEC434EA0

File PE Metadata

Compilation timestamp:

3/24/2014 1:24:10 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

10.0

Entry address:

0xE9B9

Entry point:

E8, 2D, 46, 00, 00, E9, 95, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 24, C2, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 88, C0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 88, 43, 42, 00, 89, 0D, 84, 43, 42, 00, 89, 15, 80, 43, 42, 00, 89, 1D, 7C, 43, 42, 00, 89, 35, 78, 43, 42, 00, 89, 3D... 
[+]

Entropy:

6.5415

Code size:

105.5 KB (108,032 bytes)

The file APNNativeMsgHost.exe has been discovered within the following programs.

Ask Shopping Toolbar by APN LLC

This is an Ask.com ad-injection toolbar that is bundled with various 3rd-party programs and installers. From the site: "The enhanced shopping search experience includes rich content, a variety of product listings, and visual product search results.

help.ask.com/link/portal/30015/30018/Article/227/What-features-does-the-Shopping-Toolbar-by-Ask-offer

79% remove it

Ask Toolbar by APN LLC

The Ask Toolbar is a web browser extension and toolbar that delivers contextual based advertising as well as modify the user's web browser home and search pages to provide advertising and search.

apn.ask.com

74% remove it

MediaCaster by Ask by APN, LLC

MediaCaster is an Ask.com advertising-supported web browser toolbar that may modify the browser's home page, search provider and new tab pages.

www.apn.ask.com/products/toolbars

79% remove it

Remove APNNativeMsgHost.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.