home

Client.exe

The application Client.exe has been detected as a potentially unwanted program by 10 anti-malware scanners. This executable runs as a local area network (LAN) Internet proxy server listening on port 49485 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. This file is typically installed with the program Rockettab by Rich River Media, LLC which is a potentially unwanted software program.
Version:
1.0.5679.11873

MD5:
bfd71e7b427d9e986b7356867f3ba8af

SHA-1:
e385c5567567a26d4a67f4be0e52d303fe8e3417

SHA-256:
fc18adce12e2c47243b3319fdd6621652029b63d0c1f0af1063c884b9f3ce9d4

Scanner detections:
10 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 8:50:55 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.RocketTab
2015.07.21

avast!
Win32:IBryte-EP [PUP]
2014.9-150720

Baidu Antivirus
Adware.MSIL.iBryte
4.0.3.15720

ESET NOD32
MSIL/Adware.iBryte.F application
7.0.302.0

F-Prot
W32/A-425915ce
v6.4.7.1.166

G Data
Win32.Adware.Rockettab
15.7.25

Kaspersky
UDS:DangerousObject.Multi.Generic
14.0.0.1705

Malwarebytes
PUP.Optional.RocketTab.A
v2015.07.20.10

McAfee
Program.Adware-RocketTab
18.0.204.0

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

File size:
1.4 MB (1,457,664 bytes)

Product version:
1.0.5679.11873

Original file name:
Client.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\search extensions\client.exe

File PE Metadata
Compilation timestamp:
7/20/2015 12:36:03 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:fsAJds62WtpMQ0s6nSxSlTSs7Udp0Q4GoERjQLjn4zvVct:f1Erw76nStda6oERMLj4zS

Entry address:
0x15B102

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.0994

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
1.3 MB (1,413,632 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:49485/

Local host port:
49485

Default credentials:
No


The file Client.exe has been discovered within the following program.

Rockettab  by Rich River Media, LLC
RocketTab is an adware program that injects advertising in the user's web browser by creating a local proxy server and routing all Internet traffic through that proxy. By re-routing traffic the service will be able to include various ads in the HTML of the displaying web page.
rockettab.com
88% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):
Connects to vip-chy-72-53.taleo.net  (160.34.72.53:443)

TCP (HTTP):
Connects to nl.redir.opera.com  (82.145.215.91:80)

TCP (HTTP):
Connects to ec2-50-17-205-172.compute-1.amazonaws.com  (50.17.205.172:80)

TCP (HTTP SSL):
Connects to ec2-52-206-195-243.compute-1.amazonaws.com  (52.206.195.243:443)

TCP (HTTP SSL):
Connects to any-in-2014.1e100.net  (216.239.32.20:443)

TCP (HTTP SSL):
Connects to text-lb.esams.wikimedia.org  (91.198.174.192:443)

TCP (HTTP):
Connects to s3-1.amazonaws.com  (52.216.226.11:80)

TCP (HTTP SSL):
Connects to edge-star-mini-shv-01-cdg2.facebook.com  (179.60.192.36:443)

TCP (HTTP):
Connects to ec2-54-235-170-110.compute-1.amazonaws.com  (54.235.170.110:80)

TCP (HTTP):
Connects to ec2-54-221-254-214.compute-1.amazonaws.com  (54.221.254.214:80)

TCP (HTTP):
Connects to a104-124-210-249.deploy.static.akamaitechnologies.com  (104.124.210.249:80)

TCP (HTTP SSL):
Connects to a104-124-192-223.deploy.static.akamaitechnologies.com  (104.124.192.223:443)

TCP (HTTP SSL):
Connects to 50-27-154-141.com.sta.suddenlink.net  (50.27.154.141:443)

TCP (HTTP SSL):
Connects to ssl.sc.opera.com  (82.145.223.176:443)

TCP (HTTP):
Connects to ec2-54-225-145-152.compute-1.amazonaws.com  (54.225.145.152:80)

TCP (HTTP):
Connects to ec2-54-204-8-133.compute-1.amazonaws.com  (54.204.8.133:80)

TCP (HTTP):
Connects to ec2-23-23-122-91.compute-1.amazonaws.com  (23.23.122.91:80)

TCP (HTTP):
Connects to ec2-23-21-77-170.compute-1.amazonaws.com  (23.21.77.170:80)

TCP (HTTP):
Connects to xml.opera.com  (82.145.215.42:80)

TCP (HTTP):
Connects to server-54-239-132-15.sfo9.r.cloudfront.net  (54.239.132.15:80)

Remove Client.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.