ContentExplorer.exe

Application Genius, LLC

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application ContentExplorer.exe by Application Genius has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 60283 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
ContentExplorer  (signed by Application Genius, LLC)

Product:
ContentExplorer

Version:
8.0

MD5:
cf64f2b7e0c11578651024ccaa19aa1e

SHA-1:
24ec855fe6ce48dc57f791aae0c0256d9f2aec0f

SHA-256:
c03daca0206d56cfad94db50dd85019455039a66dda24af39b8bc3a2f467f24a

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/28/2024 1:34:49 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.200.132

avast!
Win32:Adware-gen [Adw]
2014.9-150214

AVG
Generic
2016.0.3230

Baidu Antivirus
Adware.Win32.iBryte
4.0.3.15113

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
20835

Dr.Web
Trojan.iBryte.284
9.0.1.045

ESET NOD32
MSIL/Adware.iBryte (variant)
9.10994

Fortinet FortiGate
Adware/IBryte
1/13/2015

F-Secure
Adware.BrowseFox.BB
11.2015-14-02_7

McAfee
Artemis!B211B824C314
5600.6855

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Adknowledge
15.2.14.11

Sophos
Generic PUA PC
4.98

Trend Micro House Call
Suspicious_GEN.F47V0105
7.2.13

VIPRE Antivirus
iBryte
36956

File size:
2.3 MB (2,392,760 bytes)

Product version:
8.0

Copyright:
Copyright © ContentExplorer 2014

Original file name:
ContentExplorer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\contentexplorer\contentexplorer.exe

Digital Signature
Authority:
GoDaddy.com, Inc.

Valid from:
12/30/2014 9:32:38 PM

Valid to:
12/29/2016 6:07:38 PM

Subject:
CN="Application Genius, LLC", O="Application Genius, LLC", L=Walnut, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
629B575CD8F3186B

File PE Metadata
Compilation timestamp:
1/11/2015 1:00:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:Y1JRYeCSFJ0HeOUOPvQCd3TFYrxTiX29O:KJROSFJAeOVPpdhYrxOWO

Entry address:
0x247152

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.3 MB (2,380,288 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:60283/

Local host port:
60283

Default credentials:
No


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to wizard-new.net  (85.159.235.215:80)

TCP (HTTP SSL):
Connects to rio01s05-in-f19.1e100.net  (173.194.42.147:443)

TCP (HTTP SSL):
Connects to gru09s10-in-f14.1e100.net  (173.194.118.110:443)

TCP (HTTP):
Connects to gru09s10-in-f13.1e100.net  (173.194.118.109:80)

TCP (HTTP):
Connects to float.2068.bm-impbus.prod.nym2.adnexus.net  (68.67.153.176:80)

TCP (HTTP SSL):
Connects to edge-star-shv-01-ord1.facebook.com  (31.13.74.1:443)

TCP (HTTP):
Connects to ec2-54-208-30-101.compute-1.amazonaws.com  (54.208.30.101:80)

TCP (HTTP):
Connects to ec2-54-197-227-143.compute-1.amazonaws.com  (54.197.227.143:80)

TCP (HTTP):
Connects to 50.97.37.221-static.reverse.softlayer.com  (50.97.37.221:80)

TCP (HTTP):
Connects to 173.192.219.51-static.reverse.softlayer.com  (173.192.219.51:80)

TCP (HTTP):
Connects to 173.192.219.37-static.reverse.softlayer.com  (173.192.219.37:80)

Remove ContentExplorer.exe - Powered by Reason Core Security