home

smart-tolbar-remover_22.exe

X-Media JSC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application smart-tolbar-remover_22.exe by X-Media JSC has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from f1.storeglobal-best.com.
Publisher:
X-Media JSC  (signed and verified)

MD5:
ee50a2ecdefbcd918eb93cd564145b77

SHA-1:
eec1773002b4f6e9360fc508a91cd86b94066557

SHA-256:
0886eef0914d39bee271fe6e0ccf7db0743e23fa386eeff3ed92585dbe6acab2

Scanner detections:
11 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 8:09:21 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Malware-gen
140813-1

AVG
Generic
2015.0.3371

ESET NOD32
Win32/AdWare.Laban.G application
7.0.302.0

F-Prot
W32/Trojan3.KDG
4.6.5.141

IKARUS anti.virus
Trojan.Win32.StartPage
t3scan.1.7.5.0

Kaspersky
Trojan.Win32.StartPage
15.0.0.494

McAfee
Artemis!EE50A2ECDEFB
5600.7027

Reason Heuristics
PUP.installCore.XMediaJSC
15.5.3.0

Sophos
Generic PUA OO
4.98

Trend Micro House Call
Suspici.A05D7F27
7.2.238

VIPRE Antivirus
Threat.4150696
32210

File size:
1.7 MB (1,824,728 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\smart-tolbar-remover_22.exe

Digital Signature
Signed by:
X-Media JSC

Authority:
COMODO CA Limited

Valid from:
7/22/2014 7:00:00 AM

Valid to:
7/22/2016 6:59:59 AM

Subject:
CN=X-Media JSC, O=X-Media JSC, STREET="244A Le Trong Tan, Khuong Mai, Thanh Xuan", L=Ha Noi, S=Ha Noi, PostalCode=10000, C=VN

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B2A816498972D731C4998D8C6965DAA9

File PE Metadata
Compilation timestamp:
5/12/2014 3:03:42 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:eQgMQPR112lLLTkSRa3zOxJYri3PYR98AQSZsFM/O4IgYQCYRS0iX/f3HXMYbQbj:3gMQJ11GLLISRa3ixJYryg8rP5vR0I0f

Entry address:
0x30E2

Entry point:
81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 90, 91, 40, 00, 89, 5C, 24, 20, C6, 44, 24, 14, 20, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 1C, 71, 40, 00, 53, FF, 15, 8C, 72, 40, 00, 6A, 08, A3, 58, E4, 42, 00, E8, 95, 2D, 00, 00, A3, A4, E3, 42, 00, 53, 8D, 44, 24, 38, 68, 60, 01, 00, 00, 50, 53, 68, E0, 87, 42, 00, FF, 15, 64, 71, 40, 00, 68, 80, 91, 40, 00, 68, A0, DB, 42, 00, E8, 3F, 2A, 00, 00, FF, 15, 20, 71, 40, 00, BD, 00, 40, 43, 00, 50, 55, E8, 2D, 2A...
 
[+]

Entropy:
7.9914

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file smart-tolbar-remover_22.exe has been seen being distributed by the following URL.

http://f1.storeglobal-best.com/x0108/41/.../smart-tolbar-remover_22.exe

Remove smart-tolbar-remover_22.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.