home

scl_webssearches.exe

1893_scl_webssearches

Xiaoqing Liu

The application scl_webssearches.exe by Xiaoqing Liu has been detected as adware by 20 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.girlliuxiaoqing.com.
Publisher:
One Syn  (signed by Xiaoqing Liu)

Product:
1893_scl_webssearches

Description:
Syn worker

Version:
6.3.7601.1270

MD5:
86e5756e28c91eb32a74928ce6385d3a

SHA-1:
aebb1ea664240161dd818e2043d4a59fe559a524

SHA-256:
e82257b16743360a8d72c08b2d8a87248a249d1198d0e80953307685b80aa669

Scanner detections:
20 / 68

Status:
Adware

Analysis date:
11/23/2024 8:03:36 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.PAO
526

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetize
2014.11.14

avast!
Win32:Adware-gen [Adw]
2014.9-150828

Baidu Antivirus
PUA.Win32.LiMo
4.0.3.15828

Bitdefender
Adware.Agent.PAO
1.0.20.1200

Dr.Web
Adware.Mutabaha.84
9.0.1.0240

Emsisoft Anti-Malware
Adware.Agent.PAO
8.15.08.28.06

ESET NOD32
Win32/LiMo (variant)
9.10722

F-Secure
Adware.Agent.PAO
11.2015-28-08_6

G Data
Adware.Agent.PAO
15.8.24

herdProtect (fuzzy)
variant of 3nhbtgmy.0rv.exe (Adware)
2015.10.24.16

IKARUS anti.virus
PUA.SafeSurf
t3scan.1.8.3.0

Malwarebytes
PUP.Optional.Liu
v2015.08.28.06

McAfee
Artemis!D16696D8E051
5600.6602

MicroWorld eScan
Adware.Agent.PAO
16.0.0.720

nProtect
Adware.Agent.PAO
14.11.21.01

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.ELEX.XiaoqingLiu (M)
15.8.28.6

Trend Micro House Call
Suspicious_GEN.F47V1117
7.2.297

File size:
559.4 KB (572,808 bytes)

Product version:
6.3.7601.1270

Copyright:
One Syn

Original file name:
Worker.exe

File type:
Executable application (Win32 EXE)

Language:
English (United Kingdom)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\0b3og5rx\scl_webssearches.exe

Digital Signature
Signed by:
Xiaoqing Liu

Authority:
DigiCert Inc

Valid from:
8/13/2014 9:00:00 AM

Valid to:
8/17/2015 9:00:00 PM

Subject:
CN=Xiaoqing Liu, O=Xiaoqing Liu, L=Zaozhuang, S=Shandong, C=CN

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0889CED821C1220A4F950101C71E977B

File PE Metadata
Compilation timestamp:
11/13/2014 10:45:54 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:pWi/UD4QeBMhL7zyvhuwooWXlHhzfS+RJx+LTkZuyrDMDYmr:ci8DyaoW/q+eTYuyrDw3r

Entry address:
0x3F2E5

Entry point:
E8, C6, 04, 01, 00, E9, 7F, FE, FF, FF, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 98, 06, 48, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 18, 52, 47, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, 98, 06, 48, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01, 00, 00, F7, C6, 03, 00, 00...
 
[+]

Entropy:
6.1138

Code size:
378.5 KB (387,584 bytes)

The file scl_webssearches.exe has been seen being distributed by the following URL.

http://www.girlliuxiaoqing.com/.../scl_webssearches.exe

Remove scl_webssearches.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.