home

bsplayer266_1075.exe

Conduit Ltd.

The file belongs to the Conduit API platform, a utility that bundles and monetizes search toolbars and web browser extensions. The application bsplayer266_1075.exe by Conduit has been detected as a potentially unwanted program by 7 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from w.x.baidu.com and multiple other hosts.
Publisher:
Conduit Ltd.  (signed and verified)

MD5:
7ccf29710d51164e775913158a5eb58d

SHA-1:
6cdfe387b54a6e88b405167f2075373744616574

SHA-256:
29b1c43164095a75eb9e6713df5647f8777727df1fafeb6c0018bf3de3a8ee9d

Scanner detections:
7 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
11/27/2024 12:35:18 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Conduit.6
9.0.1.050

ESET NOD32
Win32/Wajam (variant)
8.9442

Fortinet FortiGate
Riskware/Wajam
2/19/2014

Panda Antivirus
PUP/Conduit.A
14.02.19.12

Reason Heuristics
PUP.Conduit.Q
14.8.7.22

Trend Micro House Call
TROJ_GEN.F47V0217
7.2.50

VIPRE Antivirus
Conduit
26624

File size:
678.8 KB (695,120 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\bsplayer266_1075.exe

Digital Signature
Signed by:
Conduit Ltd.

Authority:
VeriSign, Inc.

Valid from:
1/3/2013 1:00:00 AM

Valid to:
4/4/2016 1:59:59 AM

Subject:
CN=Conduit Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Conduit Ltd., L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3A82654719D8F75B59134F7B66465210

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:XETssZJqIjO/u0Wr4QcawsWV3zKfdzgzt2Gkrf06QwS89GR2wo68xhFu:X8s0JoDs3P+V3zKfx1rfNNS89GR299Fu

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Code size:
28 KB (28,672 bytes)

The file bsplayer266_1075.exe has been seen being distributed by the following 50 URLs.

http://w.x.baidu.com/alading/.../26016

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393907530&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=THRGIWV7~7X8dPQG2a9Zuqxbe5h5tARYJOtmE4tU7qG-VrI-oKHcp5Z3FhPEpoLCzaa5wNSgibIAm-TBEtN0MDK2lEXyqL4k~Fb1Lm2paNLfrDqbrUuaR2XTzD361K6ufzoOC6cWfwSvCQz7hKtjwAbA8APBpqEyiuBT5LFloZI_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140314132811&nva=20140315012911&token=0cc0adc6c321f43549674&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393053191&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ZnvN8as7bw7HwAr~nPVyIywlMkAP5sy-2ZgfJ73mIoep3TzMqYKVE32w2elhQjVz4wkPnMBGXHcasDegCtkN7Iqkjgmgqjr97xJoHy2EjimNXntMYSUEMYxQsbD6lBs01k3TKhZT9McZWrud-gf7tpYjJcHviQZc2pVUegaqOWY_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140316144658&nva=20140317024758&token=0785399bb814209e166d7&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140317155132&nva=20140318035232&token=0a041f3aa3a6a66c6b67d&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393328960&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=P7OefE-5MXSvlY1Kd4Z3IdcRpPHEiTH~mzSqzG0~xLI4KvXEZe2ORnB~bcBdkf6RK0AA6qkVT8suKS3tZR81aCpYt6FoBdyhSr--X-QcpREe5x6UXGzGwfJVjnmkZ6VxohGyGI59hiEvvI7DMefOEuiJUOGLqGI4oltmMW7kuEU_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140327110044&nva=20140327230144&token=0e5c2dc5cada893dd8cec&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140308125131&nva=20140309005231&token=08d477d0f97b3684fd8d0&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140311191519&nva=20140312071619&token=004d7326ca2a29246d28a&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1392703918&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=BCwAHvm4-mE3Iw1ACG70uHS2-bauqRX3uxMhO-zeqjlkaDLry6L6yKtTP0znACG229amO-z5pcbfiYIaN85q02zQQgdK4rvy9UUh2U44aqfdsgpORpwF4ECS7XJHjvabSkBIqEU951tqLsxFl9sxwbla1JGeQDf6jjn1OlnoTYk_&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393974077&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ZozK4M5fhEM2XRe2t1uozZm22KDd70gf4mqAe8rPGd2xQomQPx0TBSpTtvqQ2ilv51-kPR53BHqXqL5VXA6~Q7PRRuFk2t6yvvYPJLQ4qNRHEZ7ikEibntNiTheiJ6iPuShaUUzyCe3z-X6F-CnseJuVMBHCdgKXsY25T9zVuW8_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140318162838&nva=20140319042938&token=0ce6a21973e5188b94267&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393871389&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ftXQ~DHnJnWe4-587D6f2e7VFJIQ4KfxZrOOXB-zuX9vc1Ke7Cz~svzCrPZu4tQIW~nFXpGd7pfzUGeJwPPYBxO5rhZ8sGh8j5CuJRA~PrOboUoVjeJww56zPdM2KZn6RyG70PurFsH2j9vYsSQxKE2ZDz4nKOSYYKDBk1zIpuY_&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393648735&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=etRrd4q8Uot0RWvFZX3xSlL3nYdRnrupSc9MTQGxXnbua6tEyBrCHzgbCHa9lpqE7SuaBDABYiDD344lHE8zGnaQAkd4ltHPbiAmTsTESdIglxxhNmjMB4MFkocIJPfZnGYUUEdJ21uvPAD-Vs-uvBGvU~YvicxnKP7SunQoYVI_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140320182513&nva=20140321062613&token=0206a8a088c98f30008a0&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1394007146&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=LPfu-6Re9sTVjmLBSJfKjd2phcblZQqBvVRjzk~yG3SLKaU7s5rIzaZZ149APWejmbuv3mNyg0e10iOy2oxBWKwmhxI-M9NQIpoKRyzg~I4EIdT0QHT3eoG4ilM5wV7uxlFy78y8kOyv3TDy2tqrcBtxblZipEfD9K3l0~Tzo3Q_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140313202910&nva=20140314083010&token=0f327de2b317a14ad16fa&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1392774756&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=DCF06W3SsoOBfgLOYlZ-7~FuZ767epgEzRmdoUZo~Hz13xmwCyKjbpydQDomqD34v~XcJLk1hRh5uJ5MaxzK8nesGxstUqWNWa46WJlMwZ2ueBwa0VwNEbYrPjr4Jn-xZtjDK1vZ2tODI~lCbURiLirl9rjijV6vfcaRmfmOISE_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140320211242&nva=20140321091342&token=0c0033d361ad08cf19206&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393831360&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=SHwScYKvW-SeRdsQeRFjK42rZKkB~0xyNxk4HdrDWiFpLhWrYivzXjUoAJl45PzqF4MOkrD79VdzC4p3sRtPN672EI2dyHe2fvJT8dJmu2mJDk8Sg~3Wh4vlPDeMpHoGjLbiPE6IHjGrBAg3xkGsScOv~4GFZEv8YmI9XLwYZc0_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140319201445&nva=20140320081545&token=0e30fc7e1e44379bc9a18&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140330194257&nva=20140331074357&token=0b26bfa7f21c527cbdcd1&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140314174329&nva=20140315054429&token=0f7741bc589065814ca6b&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393909145&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=gKER2TYjsIufQtIBDz8DeDHq8~FJQ4F62ipV8sCzAbtkyG4bN8VeMMdTthbeVz6X39OVJTP8BIz1jeeu1gyLJb8cyecq~CRvavUVVRPiG0aL8n~GxWeK9Ny~r3NJFxcew9f6tWKpBDlSu1n7~osZW85HxE2sp~Y3gyjN-ecCqYk_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140314182901&nva=20140315063001&token=057ccea55882b1b4d42fc&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1394072204&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=RfLpEgCgwAw28OOlPem4thzRJtjU5XSHhV8cruEeuDfNbLA3ssoAwiUYyATJz5lBV~HVtqv5hICCfll-UDFUERlPrJ0b2lxfs0ZuklOCAZP3G3yI7NVfZnEqmY5VENxeC0Rgusz6dlUHazwy7wVeJJjR0JgMV~Eawe~eVRIoVQI_&filename=bsplayer266_1075.exe

http://global-shared-files-l3.softonic.com/6cd/fe3/.../file?nvb=20140330093939&nva=20140330214039&token=02f300cd63a0b936de3fd&id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393198877&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ap1tavzN8h7B6xU-XsmIyOUrwd1rMuNjO9lK~2zS2gPHMH1Fm83bKNRr9bJXuH-wHI6zw6W3S8nWc3BwtV5W9FaGc3ne5hGMuMrPWzU2YvgvaZph5p5bAlK5pU0W3QYjrqLh0e4shNUS6WZIO3D907AA0vgjBNY~~I6nNsdHfvw_&filename=bsplayer266_1075.exe

http://gsf-cf.softonic.com//6cd/fe3/.../file?id_file=16261&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&Expires=1393920516&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=gztuSnrOBiWxWTdHl3OlQEO3gjSFlMG~ao6ym45k1qIvO91OlOv0BeJtgODQspCYU8U9OfQtoiZd3AEIpxdrrrgOaFmXb0yIVqK1iy6lcNhIES6bquX0ynsRhKgi1xSLIv~57f5tiVYR2PM5TUdZIuqcJUQFsrKoAJDbjI70vGM_&filename=bsplayer266_1075.exe

Latest 30 of 84 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-23-23-99-139.compute-1.amazonaws.com  (23.23.99.139:80)

TCP (HTTP):
Connects to a23-55-142-140.deploy.static.akamaitechnologies.com  (23.55.142.140:80)

TCP (HTTP):
Connects to ec2-54-225-182-66.compute-1.amazonaws.com  (54.225.182.66:80)

Remove bsplayer266_1075.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.