» radio canyon-codedownloader.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (2)

radio canyon-codedownloader.exe

Sara Kodama Project

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application radio canyon-codedownloader.exe by Sara Kodama Project has been detected as adware by 38 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Radio Canyon by Bright circle investments Ltd. which is a potentially unwanted software program. Built using the Crossrider web brower toolkit the CodeDownloader component will automatically connnect to the remote API server and download additional code/components for Radio Canyon extension/toolbar. The component makes a number of requests to the host app-static.crossrider.com/plugins/.../monetization/monetizationLoader.js. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

Radio Canyon (signed by Sara Kodama Project)

Product:

Radio Canyon

Description:

Radio Canyon exe

Version:

1000.1000.1000.1000

MD5:

2fed70a08919726a730a11ffeccdf042

SHA-1:

4336d99cfb3b98391bad3b8326240a54792f2c06

SHA-256:

ce5cbe1ae01ab34c992fe265359085d0274afec09fa81170b58bb845ef00b122

Scanner detections:

38 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Sara Kodama Project.

Analysis date:

12/24/2024 1:09:20 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Heur.dv1@kqEAg8oO

805

AegisLab AV Signature

AdWare.MSIL.DomaIQ

2.1.4+

AhnLab V3 Security

PUP/Win32.CrossRider

2014.11.14

Avira AntiVirus

ADWARE/CrossRider.Gen4

7.11.186.88

avast!

Win32:Crossrider-AI [PUP]

2014.9-141122

AVG

Generic

2015.0.3283

Baidu Antivirus

PUA.Win32.CrossRider

4.0.3.141122

Bitdefender

Gen:Application.Heur.dv1@kqEAg8oO

1.0.20.1630

Clam AntiVirus

Win.Adware.Agent-12356

0.98/21411

Comodo Security

ApplicUnwnt

20071

Dr.Web

Trojan.Crossrider.41338

9.0.1.0326

Emsisoft Anti-Malware

Gen:Variant.Adware.Zusy.105499

8.14.11.24.09

ESET NOD32

Win32/Toolbar.CrossRider.AY (variant)

8.10730

Fortinet FortiGate

Adware/Adwapper

11/24/2014

F-Prot

W32/A-73a7935c

v6.4.7.1.166

F-Secure

Gen:Application.Heur.dv1@kqEAg8oO

11.2014-22-11_7

G Data

Win32.Adware.Crossrider

14.11.24

IKARUS anti.virus

Trojan.GoogUpdate

t3scan.1.8.3.0

K7 AntiVirus

Unwanted-Program

13.185.14042

Kaspersky

Trojan.NSIS.GoogUpdate

14.0.0.2908

Malwarebytes

PUP.Optional.RadioCanyon.A

v2014.11.22.09

McAfee

Artemis!0ED615CE9552

5600.6939

Microsoft Security Essentials

Threat.Undefined

1.187.339.0

MicroWorld eScan

Gen:Application.Heur.dv1@kqEAg8oO

15.0.0.978

NANO AntiVirus

Trojan.Win32.GoogUpdate.dimztp

0.28.6.62995

Norman

Sality.ZHB

11.20141124

nProtect

Adware.Agent.OMI

14.10.12.01

Panda Antivirus

Trj/Genetic.gen

14.11.22.09

Qihoo 360 Security

Win32/Virus.Adware.de5

1.0.0.1015

Quick Heal

AdWare.NSIS.r5 (Not a Virus)

11.14.14.00

Reason Heuristics

PUP.Crossrider.Task.BB

14.11.22.9

Rising Antivirus

PE:Trojan.Win32.Generic.175C6496!391931030

23.00.65.141122

Sophos

Generic PUA OP

4.98

Trend Micro House Call

TROJ_GEN.R02KC0EK314

7.2.328

Trend Micro

TROJ_GEN.R02KC0EK314

10.465.24

Vba32 AntiVirus

AdWare.Adwapper

3.12.26.3

VIPRE Antivirus

Crossrider

34834

Zillya! Antivirus

Trojan.GoogUpdate.Win32.2146

2.0.0.1953

File size:

1.1 MB (1,129,888 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Radio Canyon.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\radio canyon\radio canyon-codedownloader.exe

Digital Signature

Signed by:

Sara Kodama Project

Authority:

COMODO CA Limited

Valid from:

10/20/2014 12:00:00 AM

Valid to:

10/20/2015 11:59:59 PM

Subject:

CN=Sara Kodama Project, O=Sara Kodama Project, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

75E47031A737D2A200F0C7A94034399F

File PE Metadata

Compilation timestamp:

11/15/2014 8:35:42 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:loMlVhXnx/WveQ1W4uahNKjCzseUVl0tkpS68vTSnh:Nz/FQHuuW6kpS66TQ

Entry address:

0x9F052

Entry point:

E8, CF, 00, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, 8B, 4C, 24, 0C, 57, 85, C9, 0F, 84, 92, 00, 00, 00, 56, 53, 8B, D9, 8B, 74, 24, 14, F7, C6, 03, 00, 00, 00, 8B, 7C, 24, 10, 75, 0B, C1, E9, 02, 0F, 85, 85, 00, 00, 00, EB, 27, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 83, E9, 01, 74, 2B, 84, C0, 74, 2F, F7, C6, 03, 00, 00, 00, 75, E5, 8B, D9, C1, E9, 02, 75, 61, 83, E3, 03, 74, 13, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 84, C0, 74, 37, 83, EB, 01, 75, ED, 8B, 44, 24, 10, 5B, 5E, 5F, C3, F7, C7, 03, 00... 
[+]

Code size:

804 KB (823,296 bytes)

Scheduled Task

Task name:

9aaf316f-5ebb-4aaa-8c4b-1cb2e97d844e-1

Trigger:

Logon (Runs on logon)

Action:

radio canyon-codedownloader.exe \rawdata=qwog8pzqhdjg1hscaq0ufccudy1xg0z+vpfaugp67

The file radio canyon-codedownloader.exe has been discovered within the following program.

Radio Canyon by Bright circle investments Ltd.

Radio Canyon (Porter Studio Plus) is an adware program (supported by various types of advertising) that is usually bundled by third party installers and download managers.

88% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ip-184-168-221-45.ip.secureserver.net (184.168.221.45:80)

TCP (HTTP):

Connects to tlb.hwcdn.net (69.16.175.42:80)

Remove radio canyon-codedownloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.