home

bsplayer268.1077.exe

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application bsplayer268.1077.exe by ClientConnect has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.filehippo.com and multiple other hosts.
Publisher:
ClientConnect LTD  (signed and verified)

MD5:
5f2858106ffaa18f9c79c516c0a48118

SHA-1:
93625ebcf0addd043056f336d51ec129251c6c75

SHA-256:
6f336db00b11a6a273d81489049930dcc742143274d5a1ff55b8ff54beda15bc

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
11/5/2024 2:27:21 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-BRM [PUP]
2014.9-141127

AVG
Generic
2015.0.3277

Baidu Antivirus
Adware.Win32.Toolbar
4.0.3.141127

ESET NOD32
Win32/ClientConnect (variant)
8.10793

K7 AntiVirus
Unwanted-Program
13.186.14161

Kaspersky
not-a-virus:WebToolbar.Win32.Agent
14.0.0.2881

Malwarebytes
PUP.Optional.ClientConnect
v2014.11.27.08

Qihoo 360 Security
Win32/Virus.WebToolbar.8f1
1.0.0.1015

Reason Heuristics
PUP.ClientConnect.P
14.11.27.20

Trend Micro House Call
Suspicious_GEN.F47V1124
7.2.331

VIPRE Antivirus
Conduit
35194

File size:
740.9 KB (758,632 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Digital Signature
Signed by:
ClientConnect LTD

Authority:
VeriSign, Inc.

Valid from:
2/4/2014 8:00:00 AM

Valid to:
2/6/2016 7:59:59 AM

Subject:
CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=DM3, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
72ACCA392AFB8F2E42D5D3C0C97523F2

File PE Metadata
Compilation timestamp:
2/25/2012 3:19:59 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:XEQ+/rX875ybLnIgrY5RBlye6Orz0G9McpHCqfhGboktsCChydqGH5FYRr0LuZA8:XD+/c5YcbyGzYcpHC9dHHYW6ZggR

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.8246

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file bsplayer268.1077.exe has been seen being distributed by the following 21 URLs.

http://www.filehippo.com/download/file/.../

http://qpdownload.com/download.php?name=BSPlayer

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://files.jalantikus.com/dde/210/.../bsplayer268.1077.exe

http://www.bsplayer.com/.../downlad-free-bsplayer.php?type=1

http://www.bsplayer.com/.../download-free.html

http://dl.cdn.chip.de/downloads/.../bsplayer268.1077.exe

http://fs33.filehippo.com/4412/.../bsplayer268.1077.exe

http://filehippo.com/download/file/.../

http://fs31.filehippo.com/6218/.../bsplayer268.1077.exe

http://filehippo.com/download/file/.../

http://fs34.filehippo.com/3112/.../bsplayer268.1077.exe

http://www.filehippo.com/download/file/.../

http://fs30.filehippo.com/5392/.../bsplayer268.1077.exe

http://filehippo.com/download/file/.../

http://download10.bsplayer.com/download_free_bsplayer.php?type=1

http://download3.bsplayer.com/download_free_bsplayer.php?type=1

http://www.bsplayer.com/bsplayer-setup.exe

http://fs41.filehippo.com/7049/.../bsplayer268.1077.exe

http://www.filehippo.com/download/file/.../

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to a172-227-87-245.deploy.static.akamaitechnologies.com  (172.227.87.245:80)

TCP (HTTP):
Connects to a23-55-142-140.deploy.static.akamaitechnologies.com  (23.55.142.140:80)

TCP (HTTP):
Connects to a23-65-214-99.deploy.static.akamaitechnologies.com  (23.65.214.99:80)

TCP (HTTP):
Connects to a23-32-124-219.deploy.static.akamaitechnologies.com  (23.32.124.219:80)

TCP (HTTP):
Connects to 74-115-0-211.anchorfree.com  (74.115.0.211:80)

TCP (HTTP):
Connects to a23-223-21-153.deploy.static.akamaitechnologies.com  (23.223.21.153:80)

TCP (HTTP):
Connects to a23-2-123-19.deploy.static.akamaitechnologies.com  (23.2.123.19:80)

TCP (HTTP):
Connects to server-54-192-46-251.fra6.r.cloudfront.net  (54.192.46.251:80)

TCP (HTTP):
Connects to px-acs001.quantserve.com.akadns.net  (95.172.94.50:80)

TCP (HTTP):
Connects to pr-bh.pbp.vip.ir2.yahoo.com  (77.238.185.35:80)

TCP (HTTP):
Connects to m-prd-umpxl-adcom-mtc-b.evip.aol.com  (149.174.28.143:80)

TCP (HTTP):
Connects to mpr1.ngd.vip.ir2.yahoo.com  (217.12.15.83:80)

TCP (HTTP):
Connects to ec2-52-45-129-84.compute-1.amazonaws.com  (52.45.129.84:80)

TCP (HTTP):
Connects to ec2-52-26-195-87.us-west-2.compute.amazonaws.com  (52.26.195.87:80)

TCP (HTTP):
Connects to ec2-184-169-141-16.us-west-1.compute.amazonaws.com  (184.169.141.16:80)

TCP (HTTP):
Connects to dis.criteo.com  (74.119.117.94:80)

TCP (HTTP):
Connects to cserv-um-v01-22a.ams2.btrll.com  (185.62.216.50:80)

TCP (HTTP):
Connects to ams02-usadmm.dotomi.com  (64.158.223.137:80)

TCP (HTTP):
Connects to a23-78-196-174.deploy.static.akamaitechnologies.com  (23.78.196.174:80)

TCP (HTTP):
Connects to a23-217-166-165.deploy.static.akamaitechnologies.com  (23.217.166.165:80)

Remove bsplayer268.1077.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.