home

dc0p1i9lkpusw==2.exe

BrowserAir (GOOBZO LTD)

The application dc0p1i9lkpusw==2.exe by BrowserAir (GOOBZO) has been detected as adware by 16 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler.
Publisher:
BrowserAir (GOOBZO LTD)  (signed and verified)

Version:
2.11.0.999

MD5:
817c604a1417abd7e083973dc9017949

SHA-1:
e88087de0c72d947c634ea5c33683cef43081677

SHA-256:
6274b36eda9e4540be20c82a32c3cf7b3faef26876cd628c1757360de3241465

Scanner detections:
16 / 68

Status:
Adware

Analysis date:
11/24/2024 6:02:59 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.688663
542

Agnitum Outpost
Trojan.DR.Agent
7.1.1

Arcabit
Trojan.Kazy.DA8217
1.0.0.425

avast!
Win32:Malware-gen
2014.9-150812

Bitdefender
Gen:Variant.Kazy.688663
1.0.20.1120

Bkav FE
HW32.Packed
1.3.0.7062

Emsisoft Anti-Malware
Gen:Variant.Kazy.688663
8.15.08.12.05

Fortinet FortiGate
W32/Agent.BJPCUR!tr
8/12/2015

F-Secure
Gen:Variant.Kazy.688663
11.2015-12-08_4

G Data
Gen:Variant.Kazy.688663
15.8.25

Kaspersky
Trojan-Dropper.Win32.Agent.bjpcur
14.0.0.1594

Malwarebytes
PUP.Optional.BrowserAir.C
v2015.08.12.05

MicroWorld eScan
Gen:Variant.Kazy.688663
16.0.0.672

Panda Antivirus
Adware/Goobzo
15.08.12.05

Reason Heuristics
PUP.Goobzo (M)
15.8.12.5

VIPRE Antivirus
Trojan.Win32.Generic
42758

File size:
2.2 MB (2,326,936 bytes)

Product version:
2.11.0.999

Copyright:
Copyright (C) 2014

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\appdata\local\installer\install_12387\dc0p1i9lkpusw==2.exe

Digital Signature
Signed by:
BrowserAir (GOOBZO LTD)

Authority:
COMODO CA Limited

Valid from:
2/10/2015 4:00:00 PM

Valid to:
2/11/2016 3:59:59 PM

Subject:
CN=BrowserAir (GOOBZO LTD), O=BrowserAir (GOOBZO LTD), STREET="Bldg #15 Matam", L=Haifa, S=Haifa, PostalCode=31905, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3B4F9A8B40F303C8AAD1D77B2A2B4674

File PE Metadata
Compilation timestamp:
8/4/2015 11:59:26 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:1t0h4H8Eb+ux+Ld30QjY9fjpnPGRljv0D3QSNONa:jiu8kQE9fj9Gnb4

Entry address:
0x46C55B

Entry point:
60, 60, 88, 7C, 24, 04, E8, 8F, 44, E4, FF, E9, 4B, 27, E4, FF, 17, B8, 54, C4, 7A, C3, 0D, 33, D5, B3, 8A, F8, 17, D9, 85, FE, B2, EE, B8, 29, C5, 46, 08, 51, 1F, 39, F5, 4E, 2A, 7E, 1E, 98, 46, A7, 5D, EB, A5, FB, 9D, A9, 5F, 91, 9D, 2F, 11, 56, 7E, 47, 4C, FC, 9C, 62, E3, 85, 49, FE, F7, 44, 5C, A9, D7, A9, 65, AC, 51, 7E, 3A, 04, 1B, B7, 7F, B9, 13, 23, F7, 2F, D5, 19, 80, 1E, 15, CD, 93, 79, E0, 7C, 2A, A6, 7A, B6, AB, 45, EB, 0B, 1A, AC, 00, 3E, 9D, 3D, 1D, 26, 0A, B4, 7C, 96, A9, 93, 2D, CD, C4, 13...
 
[+]

Entropy:
7.9120  (probably packed)

Code size:
549.5 KB (562,688 bytes)

Scheduled Task
Task name:
Inst_Rep

Trigger:
Registration (Runs on registration)


Remove dc0p1i9lkpusw==2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.