home

Client.exe

The application Client.exe has been detected as a potentially unwanted program by 10 anti-malware scanners. This executable runs as a local area network (LAN) Internet proxy server listening on port 49248 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. Additionally, the file is typically installed by a number of programs including Rockettab by Rich River Media, LLC and “RocketTab” by Adknowledge, both potentially unwanted software.
Version:
1.0.5693.26842

MD5:
7274e1a1d2e6f857f0eccb5dbda5302c

SHA-1:
74e5cb87f5bb5e007961d1f64bb03dfae6241b5c

SHA-256:
42f756442b92b7ea0f4d00ce33ecee0807869f7fe1ff39085485d0687945c1e2

Scanner detections:
10 / 68

Status:
Potentially unwanted

Analysis date:
12/23/2024 11:01:00 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.RocketTab
2015.08.04

avast!
Win32:IBryte-EP [PUP]
2014.9-150804

Baidu Antivirus
Adware.MSIL.iBryte
4.0.3.1584

ESET NOD32
MSIL/Adware.iBryte.F application
6.3

F-Prot
W32/A-425915ce
v6.4.7.1.166

G Data
Win32.Adware.Rockettab
15.8.25

Kaspersky
not-a-virus:AdWare.MSIL.RocketTab
15.0.2.529

Malwarebytes
PUP.Optional.RocketTab.PrxySvrRST
v2015.08.04.01

McAfee
Program.Adware-RocketTab
18.0.204.0

Reason Heuristics
PUP.iBryte (M)
16.8.24.0

File size:
1.4 MB (1,457,664 bytes)

Product version:
1.0.5693.26842

Original file name:
Client.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\search extensions\client.exe

File PE Metadata
Compilation timestamp:
8/3/2015 9:55:01 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:J4zTWdzWrJWVi0piSB076nSFSHdAf0N7AldW1CP+3ncsw1:J4zpYsN6nSUAMN7A2Jc31

Entry address:
0x15B172

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.0991

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
1.3 MB (1,413,632 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:49248/

Local host port:
49248

Default credentials:
No


The file Client.exe has been discovered within the following programs.

“RocketTab”  by Adknowledge
RocketTab is a web browser extension that injects display advertising in the user's browser. Ads are displayed in the form of banners and contextual text-links and are both injected in white space areas of the HTML page or over existing ads of the underlying web site.
85% remove it
Rockettab  by Rich River Media, LLC
RocketTab is an adware program that injects advertising in the user's web browser by creating a local proxy server and routing all Internet traffic through that proxy. By re-routing traffic the service will be able to include various ads in the HTML of the displaying web page.
rockettab.com
88% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-221-254-214.compute-1.amazonaws.com  (54.221.254.214:80)

TCP (HTTP):
Connects to ec2-54-235-170-110.compute-1.amazonaws.com  (54.235.170.110:80)

TCP (HTTP SSL):
Connects to ec2-34-192-150-200.compute-1.amazonaws.com  (34.192.150.200:443)

TCP (HTTP SSL):
Connects to sinkhole-01.sinkhole.tech  (95.211.174.92:443)

TCP (HTTP):
Connects to ec2-54-83-200-155.compute-1.amazonaws.com  (54.83.200.155:80)

TCP (HTTP SSL):
Connects to ec2-52-72-157-241.compute-1.amazonaws.com  (52.72.157.241:443)

TCP (HTTP):
Connects to ec2-50-17-224-168.compute-1.amazonaws.com  (50.17.224.168:80)

TCP (HTTP):
Connects to ec2-23-23-122-91.compute-1.amazonaws.com  (23.23.122.91:80)

TCP (HTTP):
Connects to ec2-23-21-48-109.compute-1.amazonaws.com  (23.21.48.109:80)

TCP (HTTP):
Connects to spcms.pbp.vip.bf1.yahoo.com  (72.30.202.150:80)

TCP (HTTP):
Connects to server-54-230-59-87.gru1.r.cloudfront.net  (54.230.59.87:80)

TCP (HTTP):
Connects to server-54-230-59-226.gru1.r.cloudfront.net  (54.230.59.226:80)

TCP (HTTP):
Connects to server-54-192-59-50.gru1.r.cloudfront.net  (54.192.59.50:80)

TCP (HTTP):
Connects to server-54-192-59-179.gru1.r.cloudfront.net  (54.192.59.179:80)

TCP (HTTP):
Connects to server-52-84-40-120.ewr50.r.cloudfront.net  (52.84.40.120:80)

TCP (HTTP):
Connects to server-52-84-26-61.ewr50.r.cloudfront.net  (52.84.26.61:80)

TCP (HTTP):
Connects to server-52-84-174-8.gru50.r.cloudfront.net  (52.84.174.8:80)

TCP (HTTP):
Connects to s3-1-w.amazonaws.com  (54.231.40.139:80)

TCP (HTTP):
Connects to prod-hzeu-exebid-lba-2.dca-ops.tech  (136.243.131.49:80)

TCP (HTTP):
Connects to pr-bh.pbp.vip.bf1.yahoo.com  (72.30.2.182:80)

Remove Client.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.