home

babylon10_setup_ns.exe

Babylon Client Setup 1.0

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylon10_setup_ns.exe, “Babylon Client Setup” by Babylon has been detected as adware by 3 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.
Publisher:
Babylon Ltd.  (signed and verified)

Product:
Babylon Client Setup 1.0

Description:
Babylon Client Setup

Version:
1.0.8.0

MD5:
49259f1be1dde8f07d9e0224a7bece75

SHA-1:
8f13f61e7afeebb51d014949cae773e95537446c

SHA-256:
dc6b4cc16367e7af224b21d185cb985a5abc2a3d60b241a0e055b76a781e7a6e

Scanner detections:
3 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:
12/24/2024 1:06:31 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Bbylon
4.0.3.1492

Reason Heuristics
PUP.Installer.Babylon.S
14.9.2.14

VIPRE Antivirus
Babylon
32756

File size:
707.6 KB (724,560 bytes)

Copyright:
2011(c) Babylon Ltd. All rights reserved.

Original file name:
Setup_Stub.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\babylon10_setup_ns.exe

Digital Signature
Signed by:
Babylon Ltd.

Authority:
Thawte, Inc.

Valid from:
2/12/2014 2:00:00 AM

Valid to:
3/8/2016 1:59:59 AM

Subject:
CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata
Compilation timestamp:
7/15/2014 11:19:17 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:jblCrDcu3DGcKHoOAJKNJbjWm9AoE8nQhrrNr3GsMax6kqvBpmv7YUydYLgm:/lCfcKvKuJMJbjWmxnIrrNrEkUBMvsOl

Entry address:
0x2DB4

Entry point:
E8, DC, 20, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 68, 3B, 41, 00, E8, 96, 22, 00, 00, E8, 19, 0E, 00, 00, 0F, B7, F0, 6A, 02, E8, 6F, 20, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 50, 1A, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
50.5 KB (51,712 bytes)

The file babylon10_setup_ns.exe has been seen being distributed by the following 34 URLs.

http://www.babylon.com/.../download.cgi?type=100&d=6f36c9aa5b2af51841432723e9e8310d

http://www.babylon.com/.../download.cgi?type=100&d=b00bfca8034531f69c94d84d2b5259bb&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=03d67e99f85ba8b27775a2d33c53b4a9

http://www.babylon.com/.../download.cgi?type=100&d=cbb39354dc40434411585827bda8dc1c&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=b034e2a51d9974a625f66774f43872aa

https://bitly.com/b9lreq

http://www.babylon.com/.../download.cgi?type=100&d=6f0090bfba9c05173b37f233f97a315d

http://ewandoo.com/dbabylon.php

http://www.babylon.com/.../download.cgi?type=100&d=d2d580aedda800df3d9fbe1827175bf4

http://www.xn--6dbahbrsejm.com/babylon

http://www.babylon.com/.../download.cgi?type=100&affID=100327

http://www.babylon.com/.../download.cgi?type=100&d=cbb39354dc40434411585827bda8dc1c

http://www.babylon.com/.../download.cgi?type=100&d=f676a2a085ef0d91bc08f840eb771c3c

http://www.babylon.com/.../download.cgi?type=100&d=03fe62f45ffd92db5145c8df33df60ed

http://www.babylon.com/.../download.cgi?type=100&d=d59febc1d11ad11510d9a026465bd879

http://www.babylon.com/.../download.cgi?type=100&d=32824d28eaba0f92cb2fc50a5e37eeec

http://www.babylon.com/.../download.cgi?type=100&d=1fea42a9990df98d413a5a31d645ced0&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=a404989a5c3a356ae9fad671a21cf0fe

http://www.babylon.com/.../download.cgi?type=100&d=ec82d2333597cac63bd8de8944933a31

http://www.babylon.com/.../download.cgi?type=100&d=30078d7e7f67c22ba03beb9cd54fdbc8

http://www.babylon.com/.../babylon50_setup_eng_eng.exe

http://www.babylon.com/.../download.cgi?type=100&d=4bc32299b3ba1843dad0474cd2b881ab

http://www.babylon.com/.../download.cgi?type=100&d=5b51093481851312ea3f39fbe81a5876&hclink=1

http://newnice.info/milon-english-hebrew

http://www.babylon.com/.../download.cgi?type=100&d=f79441da3be79f308eec1b62fb4c52ba

http://www.babylon.com/.../download.cgi?type=100&d=5b51093481851312ea3f39fbe81a5876

http://www.babylon.com/.../download.cgi?type=100&affID=122406

http://www.babylon.com/.../download.cgi?type=100&d=7f9cb28266ce29cf4c1217e14e4388db

http://dl.babylon.com/site/files/.../Babylon10_setup_ns.exe

http://www.babylon.com/.../download.cgi?type=100&d=c2738506ae3f632d735e8aa0f55dc7b4

Latest 30 of 34 download URLs

Remove babylon10_setup_ns.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.