» babylon10_setup_ns.exe
Overview
Analysis
File Details
Downloads (97)

babylon10_setup_ns.exe

Visual Tools Client Setup 1.0

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylon10_setup_ns.exe, “Visual Tools Client Setup” by Babylon has been detected as adware by 13 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.

File name:

Publisher:

Visual Tools Ltd. (signed by Babylon Ltd.)

Product:

Visual Tools Client Setup 1.0

Description:

Visual Tools Client Setup

Version:

1.0.5.0

MD5:

0b29db048e512c121d0a448d73f9f494

SHA-1:

40721f571b2d376c55400dc29a799cdd403446cc

SHA-256:

5df7b0992f5fe1c6611a80da5e365520252876aae4230b83aeff029e491afb47

Scanner detections:

13 / 68

Status:

Adware

Explanation:

The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:

12/24/2024 1:09:07 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Toolbar.Babylon

7.1.1

AhnLab V3 Security

Adware/Win32.BHO

14.12.03

avast!

Win32:Adware-gen [Adw]

2014.9-141203

Baidu Antivirus

Adware.Win32.Bbylon

4.0.3.14929

Dr.Web

Adware.Downware.1733

9.0.1.0337

ESET NOD32

Win32/Toolbar.Babylon (variant)

8.9688

Fortinet FortiGate

Riskware/Toolbar_Babylon

12/3/2014

McAfee

Artemis!E569050C46CA

5600.6928

NANO AntiVirus

Trojan.Win32.Downware.ctimdd

0.28.0.59288

Reason Heuristics

PUP.Installer.Babylon.S

14.9.29.14

Trend Micro House Call

Suspicious_GEN.F47V0804

7.2.337

Trend Micro

ADW_BABYLON

10.465.03

VIPRE Antivirus

Babylon

32738

File size:

705.6 KB (722,512 bytes)

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\babylon10_setup_ns.exe

Digital Signature

Signed by:

Babylon Ltd.

Authority:

Thawte, Inc.

Valid from:

2/12/2014 1:00:00 AM

Valid to:

3/8/2016 12:59:59 AM

Subject:

CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata

Compilation timestamp:

8/6/2014 11:55:41 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:ZbJmFB2uH2nl3PB0Q31bvoNfrEewmW2sQ8YxE/u3ldbTSCwiXx4Bs90mzT:1Jmn2L3aQFcye3hthSCwih7JT

Entry address:

0x2DB4

Entry point:

E8, DC, 20, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 68, 3B, 41, 00, E8, 96, 22, 00, 00, E8, 19, 0E, 00, 00, 0F, B7, F0, 6A, 02, E8, 6F, 20, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 50, 1A, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Code size:

50.5 KB (51,712 bytes)

The file babylon10_setup_ns.exe has been seen being distributed by the following 50 URLs.

http://www.babylon.com/.../download.cgi?type=100&d=d9e2ded2e7ddd850a814dec225545df8

http://www.babylon.com/.../download.cgi?type=100&d=53f14dad2888bdceaad79028de9223e4

http://zik.co.il/b9lreq

http://www.babylon.com/.../download.cgi?type=100&d=40d39132ebecaf993a4922815b06d6a1

http://www.babylon.com/.../download.cgi?type=100&d=cdba6c61c871a501664422c833da7112&hclink=1

http://goo.gl/MOyUEN

http://www.babylon.com/.../download.cgi?type=100&d=023189ac6079726d491692036a06208e

http://www.babylon.com/.../download.cgi?type=100&d=1aaab328d1896c284adf03c376c3c2f1&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=6b6673ac8169c01b7530c01450729483

http://zik.co.il/translategooglet

http://www.babylon.com/.../download.cgi?type=100&d=659b697b28a6b64fdce5ba13435c0d11&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=3b6a6f3d04cdfdc91aef01a91aa6ed10

http://www.babylon.com/.../download.cgi?type=100&d=42be309263fd588ade5d360c72c8d1e3

http://www.babylon.com/.../download.cgi?type=100&d=1f50a4398d173620ab3b9a3768e89feb

http://www.babylon.com/.../download.cgi?type=100&d=7ac69c5d1402958cc6dc254bdb09ac76

http://www.babylon.com/.../download.cgi?type=100&d=cc12f027933665439d3bd136878f58a4&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=688598bf98e4a4c9178f1dfa8228a56d

http://www.babylon.com/.../download.cgi?type=100&d=810b972cb0057bf6458ad4e6c1b7136a

http://www.babylon.com/.../download.cgi?type=100&d=717fb533df892842bbb6f8fb9a10104c

http://www.babylon.com/.../download.cgi?type=100&d=4ed60880c8cbbff972fb24c38d16fbd5

http://www2.adtoadd.com/bannerrd.php?rand=ca8d7afabe72de239415de29f91fa201

http://www.babylon.com/.../download.cgi?type=100&d=0bfcb8630394d408d80506895506d273

http://www.babylon.com/.../download.cgi?type=100&d=3124af593bd9fb5baaec69621eb04b57

http://www.babylon.com/.../download.cgi?type=100&d=0e8ef55f987d4cc4033723bc26c886a1

http://newnice.info/milon-english-hebrew

http://www.babylon.com/.../download.cgi?type=100&d=1712354906bf961fead87b919f0ed1a7

http://www.babylon.com/.../download.cgi?type=100&d=ecdf92495e70e8d743e5a3b4989f8338

http://www.babylon.com/.../download.cgi?type=100&d=e504f32013601cf9b7a2a7ccc091b715

http://www.babylon.com/.../download.cgi?type=100&d=1fea42a9990df98d413a5a31d645ced0

http://www.babylon.com/.../download.cgi?type=100

Latest 30 of 97 download URLs

Remove babylon10_setup_ns.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.