edebe33f-15a9-49b1-ad57-3d36179bf475-10.exe

BrowserApp2.1

Browsr4App

The application edebe33f-15a9-49b1-ad57-3d36179bf475-10.exe, “BrowserApp2.1 exe” has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. While running, it connects to the Internet address server-52-85-112-131.ind6.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
Browsr4App

Product:
BrowserApp2.1

Description:
BrowserApp2.1 exe

Version:
1000.1000.1000.1000

MD5:
ef2c0123771e2921e7c9e9b6cda72441

SHA-1:
e1011bbdf80a254260c5a0439eb615b8cc2f1d8c

SHA-256:
33d5ff54aa584b999a48081fe7eaaee5360edc79b54e308d02af99b23f348c37

Scanner detections:
1 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
11/5/2024 11:00:08 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Crossrider.Browsr4App (M)
15.7.31.14

File size:
1.2 MB (1,304,064 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
BrowserApp2.1.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\browserapp2.1\edebe33f-15a9-49b1-ad57-3d36179bf475-10.exe

File PE Metadata
Compilation timestamp:
7/30/2015 11:06:04 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:HwQxgqPf3xN5Y+YeiLlF3RvHTHpSz1dSPtI3jqxvV:UShw+KLhTHpSz1cPtI3jGvV

Entry address:
0xA0EFD

Entry point:
E8, CB, 06, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, B8, D9, 51, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 58, A1, 51, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, B8, D9, 51, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8...
 
[+]

Entropy:
6.4848

Code size:
817.5 KB (837,120 bytes)

Scheduled Task
Task name:
edebe33f-15a9-49b1-ad57-3d36179bf475-10_user

Trigger:
Logon (Runs on logon)


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-240-186-200.mad50.r.cloudfront.net  (54.240.186.200:80)

TCP (HTTP):
Connects to server-54-240-186-70.mad50.r.cloudfront.net  (54.240.186.70:80)

TCP (HTTP):
Connects to server-54-240-186-210.mad50.r.cloudfront.net  (54.240.186.210:80)

TCP (HTTP):
Connects to server-54-240-186-186.mad50.r.cloudfront.net  (54.240.186.186:80)

TCP (HTTP):
Connects to server-54-240-186-123.mad50.r.cloudfront.net  (54.240.186.123:80)

TCP (HTTP):
Connects to server-54-192-36-235.jfk1.r.cloudfront.net  (54.192.36.235:80)

TCP (HTTP):
Connects to server-54-192-36-187.jfk1.r.cloudfront.net  (54.192.36.187:80)

TCP (HTTP):
Connects to server-54-192-36-178.jfk1.r.cloudfront.net  (54.192.36.178:80)

TCP (HTTP):
Connects to server-54-192-36-137.jfk1.r.cloudfront.net  (54.192.36.137:80)

TCP (HTTP):
Connects to server-52-85-112-225.ind6.r.cloudfront.net  (52.85.112.225:80)

TCP (HTTP):
Connects to server-52-85-112-224.ind6.r.cloudfront.net  (52.85.112.224:80)

TCP (HTTP):
Connects to server-52-85-112-180.ind6.r.cloudfront.net  (52.85.112.180:80)

TCP (HTTP):
Connects to server-52-85-112-131.ind6.r.cloudfront.net  (52.85.112.131:80)

TCP (HTTP):
Connects to server-52-85-112-100.ind6.r.cloudfront.net  (52.85.112.100:80)

TCP (HTTP):
Connects to server-52-84-141-86.yto50.r.cloudfront.net  (52.84.141.86:80)

TCP (HTTP):
Connects to server-52-84-141-235.yto50.r.cloudfront.net  (52.84.141.235:80)

TCP (HTTP):
Connects to server-52-84-141-226.yto50.r.cloudfront.net  (52.84.141.226:80)

TCP (HTTP):
Connects to ec2-54-225-64-155.compute-1.amazonaws.com  (54.225.64.155:80)

TCP (HTTP):
Connects to ec2-23-23-167-77.compute-1.amazonaws.com  (23.23.167.77:80)

Remove edebe33f-15a9-49b1-ad57-3d36179bf475-10.exe - Powered by Reason Core Security