gyhs.exe

CinemaHd For Pro 2.4cV31.12

Airplane Networks (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application gyhs.exe, “CinemaHd For Pro 2.4cV31.12 exe” by Airplane Networks (BrightCircle Investments Limited) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Cinema HDV31.12  (signed by Airplane Networks (BrightCircle Investments Limited))

Product:
CinemaHd For Pro 2.4cV31.12

Description:
CinemaHd For Pro 2.4cV31.12 exe

Version:
1000.1000.1000.1000

MD5:
e0bd5645442474a3f4900e83d91efe36

SHA-1:
3e570e12626074bbdf900fc8e17939b47023e42e

SHA-256:
337d6fda1763f12892119784cc08671c9ccf98dbd7dc26c56595803cc1c1f357

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/15/2024 7:36:25 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.BrightCircle (M)
17.3.12.2

File size:
2 MB (2,061,800 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
CinemaHd For Pro 2.4cV31.12.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\roaming\gyhs.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
12/1/2014 1:00:00 AM

Valid to:
12/2/2015 12:59:59 AM

Subject:
CN=Airplane Networks (BrightCircle Investments Limited), O=Airplane Networks (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00ADA185AFC7F23D3C115D613E31289B

File PE Metadata
Compilation timestamp:
12/31/2014 12:05:57 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

Entry address:
0xFD741

Entry point:
E8, 67, FD, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 56, 8B, 75, 08, 85, F6, 78, 09, E8, 9A, FE, 00, 00, 3B, 30, 7C, 07, E8, 91, FE, 00, 00, 8B, 30, E8, 84, FE, 00, 00, 8B, 04, B0, 5E, 5D, C3, 55, 8B, EC, 56, E8, 83, 5C, 00, 00, 8B, F0, 85, F6, 75, 07, B8, 60, B4, 56, 00, EB, 26, 53, 57, 33, FF, BB, 86, 00, 00, 00, 39, 7E, 24, 75, 1B, 6A, 01, 53, E8, 9D, 2E, 00, 00, 59, 59, 89, 46, 24, 85, C0, 75, 0A, B8, 60, B4, 56, 00, 5F, 5B, 5E, 5D, C3, FF, 75, 08, 8B, 76, 24, E8, 90, FF, FF, FF, 50, 53, 56, E8, FE, EA...
 
[+]

Code size:
1.2 MB (1,233,920 bytes)

Scheduled Task
Task name:
GYHS

Trigger:
Logon (Runs on logon)


Remove gyhs.exe - Powered by Reason Core Security