ContentExplorer.exe

Application Genius, LLC

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application ContentExplorer.exe by Application Genius has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 57799 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
ContentExplorer  (signed by Application Genius, LLC)

Product:
ContentExplorer

Version:
8.0

MD5:
ebe865b512d717234912fb2adb96b526

SHA-1:
9cf466aa4b843f980ce418e1447e8cd44acb3e85

SHA-256:
e6ceeccde28709147d327c407827e3415b6c0595acb12faedfdfcb6f33ed241b

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/24/2024 4:12:08 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.204.248

avast!
Win32:IBryte-JC [PUP]
150129-1

AVG
Generic
2016.0.3201

Baidu Antivirus
Adware.Win32.iBryte
4.0.3.15212

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
20835

Dr.Web
Trojan.iBryte.284
9.0.1.043

ESET NOD32
Detection.Undefined
7.0.302.0

Fortinet FortiGate
Adware/IBryte
2/12/2015

F-Secure
Adware.BrowseFox.BB
5.13.68

McAfee
Artemis!B211B824C314
5600.6857

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Adknowledge
15.2.14.11

Sophos
Generic PUA NO
4.98

Trend Micro House Call
Suspicious_GEN.F47V0104
7.2.43

VIPRE Antivirus
iBryte
36956

File size:
2.3 MB (2,392,760 bytes)

Product version:
8.0

Copyright:
Copyright © ContentExplorer 2014

Original file name:
ContentExplorer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\contentexplorer\contentexplorer.exe

Digital Signature
Authority:
GoDaddy.com, Inc.

Valid from:
12/30/2014 9:32:38 PM

Valid to:
12/29/2016 6:07:38 PM

Subject:
CN="Application Genius, LLC", O="Application Genius, LLC", L=Walnut, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
629B575CD8F3186B

File PE Metadata
Compilation timestamp:
2/11/2015 3:15:28 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:+C82eb6CJBb/5XFLLbv/7Yq4AzZJhF0KBjQ8rSsHGxtke8lta:nzeGKB/5XZLbn7HZfFbFQ8rFc8na

Entry address:
0x24714A

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.3 MB (2,380,288 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:57799/

Local host port:
57799

Default credentials:
No


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-225-25.gig50.r.cloudfront.net  (54.230.225.25:80)

TCP (HTTP):
Connects to gru09s09-in-f3.1e100.net  (173.194.118.67:80)

TCP (HTTP):
Connects to gru06s09-in-f0.1e100.net  (173.194.118.0:80)

TCP (HTTP):
Connects to ec2-54-82-55-117.compute-1.amazonaws.com  (54.82.55.117:80)

TCP (HTTP):
Connects to ec2-54-232-247-130.sa-east-1.compute.amazonaws.com  (54.232.247.130:80)

TCP (HTTP):
Connects to ec2-54-232-113-22.sa-east-1.compute.amazonaws.com  (54.232.113.22:80)

TCP (HTTP):
Connects to ec2-54-225-80-60.compute-1.amazonaws.com  (54.225.80.60:80)

TCP (HTTP):
Connects to ec2-54-208-30-101.compute-1.amazonaws.com  (54.208.30.101:80)

TCP (HTTP):
Connects to ec2-54-196-192-2.compute-1.amazonaws.com  (54.196.192.2:80)

TCP (HTTP):
Connects to ec2-54-175-1-255.compute-1.amazonaws.com  (54.175.1.255:80)

TCP (HTTP):
Connects to ec2-107-22-176-10.compute-1.amazonaws.com  (107.22.176.10:80)

TCP (HTTP):
Connects to dl22.clickmein.com  (216.227.128.162:80)

TCP (HTTP):
Connects to dl16.clickmein.com  (50.7.99.2:80)

Remove ContentExplorer.exe - Powered by Reason Core Security