hdpurev9.5-novainstaller.exe

HDPureV9.5

Robokid Technologies

By using the Crossrider framework, this web extension is loaded in the web browser and displays advertisments on web pages not affiliated by the extension or company. These unwanted advertisements are injected by the extension in the browser in the form of common ad types such as banners and text-links. The application hdpurev9.5-novainstaller.exe by Robokid Technologies has been detected as adware by 33 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
HDPure  (signed by Robokid Technologies)

Product:
HDPureV9.5

Description:
HDPureV9.5 exe

Version:
1000.1000.1000.1000

MD5:
0a2c89d994fa13cf995d4cf568810035

SHA-1:
055c7dc2ffd565dfdc43f95aca4ea4ea486bf78e

SHA-256:
099f159a381be33c999c9d8444c791b29e7bd9b90c795c26a122a169068cfdc8

Scanner detections:
33 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Analysis date:
11/23/2024 7:49:38 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Application.Heur.Iu1@mGvA79dO
434

AhnLab V3 Security
PUP/Win32.CrossRider
2015.08.11

Avira AntiVirus
ADWARE/CrossRider.Gen2
8.3.1.6

Arcabit
Application.Heur.EDFF8E
1.0.0.425

avast!
Win32:Crossrider-AG [PUP]
2014.9-151127

AVG
Crossrider
2016.0.2912

Baidu Antivirus
Adware.Win32.CrossAd
4.0.3.151127

Bitdefender
Gen:Application.Heur.Iu1@mGvA79dO
1.0.20.1655

Bkav FE
W32.HfsAdware
1.3.0.7062

Comodo Security
ApplicUnwnt
22976

Dr.Web
Trojan.Crossrider1.32446
9.0.1.0331

ESET NOD32
Win32/Toolbar.CrossRider.AJ potentially unwanted (variant)
9.12073

Fortinet FortiGate
Riskware/Toolbar_CrossRider
11/27/2015

F-Prot
W32/S-a64d6097
v6.4.7.1.166

F-Secure
Gen:Application.Heur.Iu1@mGvA79dO
11.2015-27-11_6

G Data
Gen:Application.Heur.Iu1@mGvA79dO
15.11.25

K7 AntiVirus
Unwanted-Program
13.207.16840

Kaspersky
not-a-virus:WebToolbar.Win32.CroRi
14.0.0.1057

Malwarebytes
PUP.Optional.HDPure.A
v2015.11.27.12

McAfee
RDN/Generic PUP.z
5600.6568

MicroWorld eScan
Gen:Application.Heur.Iu1@mGvA79dO
16.0.0.993

NANO AntiVirus
Riskware.Win32.AdLoad.dcexna
0.30.24.3079

Panda Antivirus
Trj/Genetic.gen
15.11.27.12

Qihoo 360 Security
HEUR/Malware.QVM10.Gen
1.0.0.1015

Quick Heal
PUA.GoogleUpdate.A5
11.15.14.00

Reason Heuristics
PUP.Brightcircle.RobokidTechnologies.Installer (M)
15.11.27.12

Rising Antivirus
PE:Adware.Kazy!6.2057
23.00.65.151125

Sophos
AppRider (PUA)
4.98

SUPERAntiSpyware
Adware.CrossRider/Variant
9482

Trend Micro
TROJ_GEN.R002C0EGS15
10.465.27

Vba32 AntiVirus
AdWare.AdLoad
3.12.26.4

VIPRE Antivirus
Crossrider
42778

Zillya! Antivirus
Backdoor.PePatch.Win32.38489
2.0.0.2345

File size:
549 KB (562,200 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
HDPureV9.5.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\hdpurev9.5\hdpurev9.5-novainstaller.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
6/23/2014 1:00:00 AM

Valid to:
6/24/2015 12:59:59 AM

Subject:
CN=Robokid Technologies, O=Robokid Technologies, STREET=Athinodorou 3 Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00ECF35E880AD0F3BC6F82DFB1F2E84CC0

File PE Metadata
Compilation timestamp:
7/9/2014 11:04:19 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:ekPlr1modXNRC3g84zdZQjMM2W4HqTf3gjVnbXBL7ExdpTBAQ1xSkE8J14xm:eEZ5N03g/jQWnKL30ZXB/ExdpT2SK8v

Entry address:
0x489B8

Entry point:
E8, F7, CA, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, E0, 4E, 48, 00, E8, 02, 4A, 00, 00, E8, 76, 1D, 00, 00, 0F, B7, F0, 6A, 02, E8, 8A, CA, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, B0, 87, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
438.5 KB (449,024 bytes)

Scheduled Task
Task name:
15c75e1d-be40-45bf-8eb5-3189f51b490f-1

Trigger:
Logon (Runs on logon)


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ip-50-63-202-36.ip.secureserver.net  (50.63.202.36:80)

TCP (HTTP):
Connects to s3-website-us-east-1.amazonaws.com  (54.231.50.9:80)

Remove hdpurev9.5-novainstaller.exe - Powered by Reason Core Security