home

couponxplorercrxsetup.1bfb4eb4-92cf-4225-8e43-0727aab527dc.exe

Mindspark Interactive Network

The application couponxplorercrxsetup.1bfb4eb4-92cf-4225-8e43-0727aab527dc.exe by Mindspark Interactive Network has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from ak.imgfarm.com. While running, it connects to the Internet address anx.mindspark.com on port 80 using the HTTP protocol.
Publisher:
CouponXplorer  (signed by Mindspark Interactive Network)

Product:
CouponXplorer

Version:
2, 1, 0, 2

MD5:
244507a425ae8ef5e768b7ddae0719d5

SHA-1:
7074209101f9752e2fcc3275601042d96a261c82

SHA-256:
7b06c5926a9e473ca9f4a7225c9f8a6b3a5cb045d0c56d186e42eb8369e98b44

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/27/2024 9:26:41 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Mindspark (M)
16.8.9.5

File size:
1.4 MB (1,500,032 bytes)

Product version:
2, 1, 0, 2

Copyright:
Copyright © 2012

Original file name:
5zSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\couponxplorercrxsetup.1bfb4eb4-92cf-4225-8e43-0727aab527dc.exe

Digital Signature
Signed by:
Mindspark Interactive Network

Authority:
VeriSign, Inc.

Valid from:
4/9/2012 8:00:00 PM

Valid to:
5/6/2015 7:59:59 PM

Subject:
CN=Mindspark Interactive Network, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Mindspark Interactive Network, L=White Plains, S=NewYork, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
098417F7EA6406EC7B320590E17A65B7

File PE Metadata
Compilation timestamp:
2/19/2013 11:26:38 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:V71FpPoztrWoKoLDtSFDwy++ijRlrvbAYV/BKEXKI/i5yZRB:V71FZQtrWofZSFEy++Ez9n/i5yN

Entry address:
0xECC1

Entry point:
E8, 9A, 58, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 51, 8B, 55, 08, 57, 8B, F8, 3B, FA, 76, 6C, 8B, 4D, 0C, 8D, 04, 0A, 53, 89, 45, FC, 56, EB, 03, 8D, 49, 00, 8B, 75, FC, 8B, DA, 3B, F7, 77, 22, 8D, A4, 24, 00, 00, 00, 00, 53, 56, FF, 55, 10, 83, C4, 08, 85, C0, 7E, 02, 8B, DE, 03, 75, 0C, 3B, F7, 76, EB, 8B, 4D, 0C, 8B, 55, 08, 8B, F1, 8B, C7, 3B, DF, 74, 21, 85, C9, 74, 1D, 8B, CB, 2B, CF, EB, 03, 8D, 49, 00, 8A, 18, 8A, 14, 01, 88, 1C, 01, 88, 10, 40, 4E, 75, F2, 8B, 4D, 0C...
 
[+]

Entropy:
5.9965

Code size:
94.5 KB (96,768 bytes)

The file couponxplorercrxsetup.1bfb4eb4-92cf-4225-8e43-0727aab527dc.exe has been seen being distributed by the following URL.

http://ak.imgfarm.com/images/nocache/vicinio/installers/208153579.S05386.1/83225-130412114947-S05386.1/.../CouponXplorerCrxSetup.1BFB4EB4-92CF-4225-8E43-0727AAB527DC.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www187.mindspark.com  (74.113.233.187:80)

TCP (HTTP):
Connects to anx.mindspark.com  (74.113.233.187:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.