» babylon10_setup_ns.exe
Overview
Analysis
File Details
Downloads (14)

babylon10_setup_ns.exe

Visual Tools Client Setup 1.0

Babylon Software

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylon10_setup_ns.exe, “Visual Tools Client Setup” by Babylon Software has been detected as adware by 7 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.

File name:

Publisher:

Visual Tools Ltd. (signed by Babylon Software)

Product:

Visual Tools Client Setup 1.0

Description:

Visual Tools Client Setup

Version:

1.0.5.0

MD5:

1bc55a05e854c13dae6a7954703a550f

SHA-1:

f47a8820249f38245169b65323b5506a0fd3a1d3

SHA-256:

f29dc66f8a1016acd540a915834097f9c01f8818a6ce99f06952c7e9f66a15f4

Scanner detections:

7 / 68

Status:

Adware

Explanation:

The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:

12/25/2024 12:27:40 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Toolbar.Babylon

7.1.1

Dr.Web

Adware.Searcher.2766

9.0.1.0129

ESET NOD32

Win32/Toolbar.Babylon.AD (variant)

9.10963

IKARUS anti.virus

PUA.Toolbar.Babylon

t3scan.1.8.5.0

K7 AntiVirus

Trojan

13.202.15549

NANO AntiVirus

Riskware.Win32.Searcher.dotdbm

0.30.10.952

Reason Heuristics

PUP.Installer.Babylon

15.2.14.11

File size:

707.4 KB (724,336 bytes)

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\babylon10_setup_ns.exe

Digital Signature

Signed by:

Babylon Software

Authority:

VeriSign, Inc.

Valid from:

12/7/2014 6:00:00 PM

Valid to:

12/7/2016 5:59:59 PM

Subject:

CN=Babylon Software, O=Babylon Software, L=Or Yehuda, S=Tel Aviv, C=IL

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

7B8E754BED548B30647F4329D78D3F91

File PE Metadata

Compilation timestamp:

10/22/2014 3:00:48 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:MPTM7CEioG2nl3PB0Q31bvoNfrEewmW2sQ8YxE/u3ldbTSCwiXx4Bs90mzk:0I7viod3aQFcye3hthSCwih7Jk

Entry address:

0x2703

Entry point:

E8, 10, 1D, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 48, 3A, 41, 00, E8, C7, 1E, 00, 00, E8, EC, 01, 00, 00, 0F, B7, F0, 6A, 02, E8, A3, 1C, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 84, 16, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Entropy:

7.8238 (probably packed)

Code size:

51.5 KB (52,736 bytes)

The file babylon10_setup_ns.exe has been seen being distributed by the following 14 URLs.

http://ppdjs.brothersoft.com/ppd_stat.php?url=/d.php?soft_id=48245&url=http://www.babylon.com/redirects/download.cgi?type=100&affID=115144&c=a9c2qdPbhEY0Lfrq3hTr/ue8s1hpF/.../sEcyzVTHMnhj9Qc1I J2Kq6bUcCrPCLtPjCAVuDzjRr5PjA52n62lga9KvbwJtl0zREMpdsfQfDOy8jLkYwEA2vItLqOVQNnNUjulbh58xoDqyrm81m0 qTG2upCD8trgD0fLPf9Js9GSwy4

http://www.babylon.com/.../download.cgi?type=100&d=aa82b8539b930d24836d7b212557e006

http://www.babylon.com/.../download.cgi?type=100&d=38a28b2b39c6922d41980593e7fa15a6

http://www.babylon.com/.../download.cgi?type=100&affID=14353

http://www.babylon.com/.../download.cgi?type=100&d=f9d70707541dfe1f9585cc71008af99d

http://www.babylon.com/.../download.cgi?type=100&d=e6e4263fa2d6d74597fe58160646d97d

http://www.babylon.com/.../download.cgi?type=100&d=bfd552eba4e9bfee5908dd835b82d9b6

http://www.babylon.com/.../download.cgi?type=100&d=d8e86ecf4bf5c3b2d623a25a0f502e99

http://www.babylon.com/.../download.cgi?type=100&d=ba8e61fa35cbddb51effada07161d1be

http://www.babylon.com/.../download.cgi?type=100&d=bc17a65b0210bcfe1e22ea2557c448c7

http://dl.babylon.com/site/files/.../Babylon10_setup_ns.exe

http://www.babylon.com/.../download.cgi?type=100&d=6d5910972cf4231abb6732dc7a116c19

http://www.babylon.com/.../download.cgi?type=100&d=686f15675813c74b1b4730fe5cd3575f

http://www.babylon.com/.../download.cgi?type=100&d=437d496e1019eaf027f1c9d34ef8f51b

Remove babylon10_setup_ns.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.