home

red_webssearches.exe

2431_red_webssearches

Xiaoqing Liu

The application red_webssearches.exe by Xiaoqing Liu has been detected as adware by 5 anti-malware scanners. It is also typically executed from the user's temporary directory.
Publisher:
TabMain  (signed by Xiaoqing Liu)

Product:
2431_red_webssearches

Description:
TabMain

Version:
6.3.76.1510

MD5:
9a10f5567e114f3df33e0b5c2d7af6cb

SHA-1:
52e263d28aa92a1c626e5f7d6618ca16de2b5d28

SHA-256:
6322c690a47128f9f52257fa352e3d0b3ec0f48c8a115a943b43d453370bb3bf

Scanner detections:
5 / 68

Status:
Adware

Analysis date:
12/25/2024 12:49:07 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.3154

herdProtect (fuzzy)
variant of 7rkbn3qqyi.exe (Adware)
2015.7.5.2

Reason Heuristics
PUP.Li Mo
15.3.31.5

Sophos
Elex
4.98

VIPRE Antivirus
Trojan.Win32.Generic
36740

File size:
312.4 KB (319,944 bytes)

Product version:
6.3.76.1510

Copyright:
Copyright (C) 2014

Original file name:
TMain.exe

File type:
Executable application (Win32 EXE)

Language:
English (United Kingdom)

Common path:
C:\users\{user}\appdata\local\temp\red_webssearches.exe

Digital Signature
Signed by:
Xiaoqing Liu

Authority:
DigiCert Inc

Valid from:
8/13/2014 1:00:00 AM

Valid to:
8/17/2015 1:00:00 PM

Subject:
CN=Xiaoqing Liu, O=Xiaoqing Liu, L=Zaozhuang, S=Shandong, C=CN

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
01D9E1C9DEA81DDCA65062CC18203480

File PE Metadata
Compilation timestamp:
12/25/2014 9:00:08 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:WuXLniLNovMo8Gw+eVtUuQSDRycoVsAPFNUQL0pfJ:NX+av6RHUZSDDoeAdNgJ

Entry address:
0x1A44B

Entry point:
E8, 32, C2, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B...
 
[+]

Entropy:
6.2919

Code size:
194.5 KB (199,168 bytes)

Remove red_webssearches.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.