home

minibarfirefox.exe

The executable minibarfirefox.exe has been detected as malware by 12 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from vzapp.iminent.com a known adware distribution point operated by SIEN S.A..
MD5:
18753f7145b2e3a0f539aed06969bf8f

SHA-1:
746ac280564e9469e63eba876d4d13d1e71ae056

SHA-256:
fe843985895c1748e75a01163d1015f298d5c2738edc99c28cea26d91abe8308

Scanner detections:
12 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
11/30/2024 7:57:39 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160503-1

AVG
Win32/Sality
2015.0.4568

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
16.05.20

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.E.gen
4.6.5.141

F-Secure
Trojan.Script.617354
5.15.96

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.219.2198.0

Norman
Win32.Sality.3
19.05.2016 05:17:13

VIPRE Antivirus
Threat.4721115
49494

File size:
1.2 MB (1,232,544 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\minibarfirefox.exe

File PE Metadata
Compilation timestamp:
6/9/2012 7:19:49 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:t2B/GlLveNFi/agz0k2+XkjKU3dpHda9QeYi7IhA9dpWPasPOAaZW0l3BezclL65:rvMgz0k2sqOQFmIUfeasa8+3IQl+5

Entry address:
0xAC87

Entry point:
87, D8, F6, C3, 86, FE, CE, 34, EE, 8A, FC, 47, 0F, BE, DF, 22, C2, 2B, CF, 81, E3, 69, 78, 0C, 55, FE, C4, EB, 06, F6, C3, 9B, 0F, AF, D9, 87, D2, B7, 18, 69, EB, 7E, 90, 0C, DF, F3, 0C, 8E, 8A, F8, 68, 0F, 4A, 13, 00, 02, E7, 69, F5, F3, 96, 23, 80, E8, 00, 00, 00, 00, 6A, 00, 5B, C6, C5, 83, 32, F5, 14, D3, 88, D5, 81, C3, 54, 0D, 00, 00, 8A, CE, 0F, AF, EF, 69, D0, 75, 4A, A0, 34, 81, EB, 53, 0D, 00, 00, B0, 14, 85, F9, FF, C5, 49, 85, F8, BE, 3C, 68, 0F, 28, 09, DD, FE, C6, 81, FB, 04, 07, 00, 00, 0F...
 
[+]

Code size:
73 KB (74,752 bytes)

The file minibarfirefox.exe has been seen being distributed by the following URL.

http://vzapp.iminent.com/vz/c2c3ac84-2b90-47a7-8e0b-a48cbcac2cec/.../MinibarFirefox.exe

Remove minibarfirefox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.