home

First Offer LTD

Publisher Information

First Offer LTD is a brand of publishers/developers run by WebPick Internet Holdings Ltd. located in Ramat Ha'Chayal Tel Aviv, Israel. The company is a primary distributor of unwanted software. First Offer LTD is a developer of WebPick Internet Holdings and publishes a number of adware web browser plugins designed to monitor web browser behavior and inject advertisements (banner, popups, text-links, etc.) in the browser by using the WebPick InstalleRex monetization delivery platform. These programs from First Offer LTD are typiclaly installed on a variety of names and misspellings and are very difficult to remove. According to WebPick, they use developers to sign their adware in order to "throw off competitors". There is one additional code signing certificate issued to this publisher.
Authority:
COMODO CA Limited

Valid from:
12/2/2014 4:00:00 PM

Valid to:
12/2/2017 3:59:59 PM

Subject:
CN=First Offer LTD, O=First Offer LTD, STREET=Habarzel 21, L=Tel aviv, S=Israel, PostalCode=69710, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
4a3c8068106af46772f0e970db0b000d

Scanner detections:
Detections  (88% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.WebPick.FirstOffer (M), PUP.WebPick.FirstOffer.Toolbar (M), PUP.WebPick.FirstOff.Installer (M), PUP.WebPick.FirstOff (M), Common.PartOf.PUP.WebPick.FirstOff (M), PUP.WebPick.FirstOff.Bundler (M), PUP.WebPick.FirstOff.Toolbar (M), PUP.WebPick (M)
100.00%

1 / 68      (Adware)
launcher.exe (Toolbar_Exe_Launcher_Form)  (b80e55a471f8c108e8fc13556646210a)

1 / 68      (Adware)
wbrokerhandler.exe (AsyncSystemSockets)  (44caedb98ec9b15c46d87fce5bc8f2f8)

1 / 68      (Adware)
wsystemupgrade.exe (TBUpdater)  (2dc654127150dfaf24ecd8f62ef90f55)

1 / 68      (Adware)
wdapimng_64.exe (Widdit by One Floor App)  (a7b273ecc43aa95b323052ccd2e547cd)

1 / 68      (Adware)
wdapimng.exe (Widdit by One Floor App)  (3d8d06c46d9a310751638addafdc7ac5)

1 / 68      (Adware)
toolbaruninstall.exe (ToolbarUninstall)  (fbf933010ec622892de52ff9cace6152)

1 / 68      (Adware)
taskschedulercreator.exe (TaskSchedulerCreator by Simplygen)  (7fa975fdaa5032965e1a4fdb8180fba3)

1 / 68      (Adware)
ToolbarUninstall.exe (ToolbarUninstall)  (b551c9c9c6d3778b4c39e1b262d536f2)

1 / 68      (Adware)
TBUpdater.dll (Widdit by One Floor App)  (f84442f6b7b78fb80a55dd2a0b4e9b86)

1 / 68      (Adware)
TaskSchedulerCreator.exe (TaskSchedulerCreator by Simplygen)  (5da4f37996ccd0648ad38334e06376f3)

1 / 68      (inconclusive)
Microsoft.Win32.TaskScheduler.dll (TaskService by CodePlex Community)  (fb66e111accdc96d16bc81dce8d4187a)

1 / 68      (Adware)
Launcher.exe (Toolbar_Exe_Launcher_Form)  (b6c4f3b12b87cb0c4aa2c75264fa9b3b)

1 / 68      (Adware)
pricecongress.dll (FirstOfferz by FirstOfferz)  (50f5d8c46515bd962e0e9210d346e0f4)

1 / 68      (Adware)
wdapimng_64.exe (Widdit by One Floor App)  (2ae5958b7287258bc4765356ce16f988)

1 / 68      (Adware)
wdapimng.exe (Widdit by One Floor App)  (575fae77be90ad4393d5fa53fdf03a72)

1 / 68      (Adware)
wdapimng_64.exe (Widdit by One Floor App)  (226a2ea266f676cb955a3e9c2df215b9)

1 / 68      (Adware)
wdapimng.exe (Widdit by One Floor App)  (b3cd3f015f77e9a89a485761ffec638d)

1 / 68      (Adware)
unins000.exe  (0fe8fb0ac32dab899a58d94099efceff)

1 / 68      (Adware)
unins000.exe  (505dfa57ff5ae18a43fde886b2389b3c)

1 / 68      (Adware)
ToolbarUninstall.exe (ToolbarUninstall)  (b775e5aa1a736974f9a5d1aaf9d3b969)

1 / 68      (Adware)
TBUpdater.dll (Widdit by One Floor App)  (2fbe26c54e6b53e98bfdd9fc09014ea0)

1 / 68      (Adware)
TaskSchedulerCreator.exe (TaskSchedulerCreator by Simplygen)  (45003b5121622e866231f127382b9cc7)

1 / 68      (inconclusive)
System.Data.SQLite.dll (System.Data.SQLite by http://system.data.sqlite.org/)  (acac980a60bdea7d415cf135f9a4280f)

1 / 68      (inconclusive)
SQLite.Interop.dll (System.Data.SQLite by Robert Simpson, et al)  (8835420c2c47c0487d532aba65aa786f)

1 / 68      (Adware)
SQLite.Designer.dll (System.Data.SQLite by http://system.data.sqlite.org/)  (d31fc40bbfc9239de567f0b718bfccc7)

1 / 68      (inconclusive)
Microsoft.Win32.TaskScheduler.dll (TaskService by CodePlex Community)  (b1b59bfc090b6615a339936b91203be8)

1 / 68      (inconclusive)
Interop.IWshRuntimeLibrary.dll (Assembly imported from type library 'IWshRuntimeLibrary'.)  (02fbfef3552137953a0d4779c57e2cd8)

1 / 68      (Adware)
InstallHelper.dll (ToolbarInnoSetupHelper)  (eb8a5b1938ec2899ff3911110fc9f71b)

1 / 68      (Adware)
cinshlpr.dll (Widdit by One Floor App)  (2a79d92e20229c731a9eaba5258cc9e3)

1 / 68      (Adware)
wdapimng.exe (Widdit by One Floor App)  (dd0e3af1172db7d682cca92783ee0b90)

 
Latest 30 of 147 files

The following certificate is also signed by First Offer LTD.

49900242461D96CB7B045BE0A258338E  (Oct 07, 2013 to Oct 08, 2014)

The following publishers (by Authenticode signature organization name) are related.

One Floor App

Ivan Kostin

WEB PICK - INTERNET HOLDINGS LTD

Artur Kozak

Daniel Hareuveni

* Note, the details and description above are based on the code signing digital signature issued to First Offer LTD by COMODO CA Limited on December 02, 2014 with the serial number '4a3c8068106af46772f0e970db0b000d'.
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.