home

file_3766634699.exe

Search Safer Inc.

The application file_3766634699.exe by Search Safer has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from d18okb3pa33axu.cloudfront.net.
Publisher:
Search Safer Inc.  (signed and verified)

MD5:
a5d6c48c265ebc1e69d4fbc8c4c9130a

SHA-1:
b6bceea57b8a5b982b7a0d59ed9a3f0657212d0c

SHA-256:
4646bdfba71e88c1ac5f1922b08924584747c303c251ee1cd39b1f6ac4a862d9

Scanner detections:
6 / 68

Status:
Adware

Analysis date:
11/24/2024 12:08:26 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Trojan/Win32.Agent
2014.08.04

AVG
MalSign.SeSafer
2015.0.3354

herdProtect (fuzzy)
variant of file_3795464714.exe (Adware)
2014.9.12.3

Reason Heuristics
PUP.SearchSafer.P
14.8.8.0

Sophos
SafeSearch
4.98

VIPRE Antivirus
Threat.4895342
31208

File size:
3.7 MB (3,840,168 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\file_3766634699.exe

Digital Signature
Signed by:
Search Safer Inc.

Authority:
DigiCert Inc

Valid from:
3/27/2014 5:00:00 PM

Valid to:
2/10/2016 4:00:00 AM

Subject:
CN=Search Safer Inc., O=Search Safer Inc., L=San Francisco, S=California, C=US, PostalCode=94107, STREET=665 3rd st, STREET=suite 150, SERIALNUMBER=5189473, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0FB2AC8CD06CF9C5F2569B9DEBE2D0AE

File PE Metadata
Compilation timestamp:
12/5/2009 2:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:C3dOqmElv/ABFsovQwrJ4yU2CBo2r5onBHE9ahGL9F:C3HmG3Ak2Qwzl1CaU9F

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9991

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file file_3766634699.exe has been seen being distributed by the following URL.

https://d18okb3pa33axu.cloudfront.net/.../pcupdater3.exe

Remove file_3766634699.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.