» TheAnswerFinder.exe
Overview
Analysis
File Details
Behaviors (1)
Network (10)

TheAnswerFinder.exe

TheAnswerFinder

Mime Ventures LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application TheAnswerFinder.exe by Mime Ventures has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 49987 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins.

File name:

TheAnswerFinder.exe

Publisher:

Mime Ventures (signed by Mime Ventures LLC)

Product:

TheAnswerFinder

Version:

1.0

MD5:

0066ba41eb5f3b2650b1bd6a0337fcf4

SHA-1:

6e125190c531f93b6673ea29d0572977e8b5f30f

SHA-256:

feaecfebe2db0e3db422879ba41869bad5c2ba0a8bf95608f546599ff11af21e

Scanner detections:

20 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/26/2024 12:24:37 AM UTC (today)

Scan engine

Detection

Engine version

AegisLab AV Signature

AdWare.W32.InstallBrain

2.1.4+

AhnLab V3 Security

Adware/Win32.IBryte

2015.01.25

Avira AntiVirus

Adware/iBryte.plsaza

7.11.204.224

avast!

Win32:IBryte-JD [PUP]

150129-1

AVG

Generic

2016.0.3200

Baidu Antivirus

Adware.Win32.TheAnswerFinder

4.0.3.15212

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

ApplicUnwnt

20265

Dr.Web

Trojan.iBryte.302

9.0.1.05190

ESET NOD32

MSIL/Adware.iBryte.P application

7.0.302.0

Fortinet FortiGate

Adware/IBryte

2/12/2015

IKARUS anti.virus

AdWare.AgentCV

t3scan.1.8.6.0

Malwarebytes

PUP.Optional.TheAnswerFinder.A

v2015.02.12.08

McAfee

Artemis!9AB594C3DE9A

5600.6856

Norman

IBryte.AJQ

11.20150212

Qihoo 360 Security

HEUR/QVM03.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Softpulse

15.2.12.20

Trend Micro House Call

Suspicious_GEN.F47V1120

7.2.43

Trend Micro

TROJ_GEN.R02KC0OAN15

10.465.12

VIPRE Antivirus

iBryte

36934

File size:

1.7 MB (1,786,312 bytes)

Product version:

1.0

Original file name:

TheAnswerFinder.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\theanswerfinder\theanswerfinder.exe

Digital Signature

Signed by:

Mime Ventures LLC

Authority:

GlobalSign nv-sa

Valid from:

10/17/2014 12:39:32 PM

Valid to:

10/18/2015 12:39:32 PM

Subject:

E=admin@theanswerfinder.com, CN=Mime Ventures LLC, OU=TheAnswerFinder.com, O=Mime Ventures LLC, L=Los Angeles, S=California, C=US

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121EDDEAF81A380FF278B94B619A213DEEE

File PE Metadata

Compilation timestamp:

2/12/2015 11:31:47 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

49152:N0JaMLl3xrfn3hh4+jX1GQ3YVCpeVAZxCVR2RF:YnBtnLBcQ3nQiN

Entry address:

0x1B1682

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.7046

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.7 MB (1,767,424 bytes)

Local Proxy Server

Proxy for:

Internet Settings

Local host address:

http://127.0.0.1:49987/

Local host port:

49987

Default credentials:

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to waws-prod-ch1-005.cloudapp.net (23.96.209.155:80)

TCP (HTTP):

Connects to static-204-137-31-103.adknowledge.com (204.137.31.103:80)

TCP (HTTP SSL):

Connects to server-54-192-91-51.ind6.r.cloudfront.net (54.192.91.51:443)

TCP (HTTP SSL):

Connects to server-54-192-89-198.ind6.r.cloudfront.net (54.192.89.198:443)

TCP (HTTP SSL):

Connects to rtr2.l7.search.vip.bf1.yahoo.com (98.137.201.252:443)

TCP (HTTP SSL):

Connects to l3.ycs.vip.che.yahoo.com (216.115.96.176:443)

TCP (HTTP):

Connects to ec2-54-209-3-129.compute-1.amazonaws.com (54.209.3.129:80)

TCP (HTTP):

Connects to ec2-54-208-30-101.compute-1.amazonaws.com (54.208.30.101:80)

TCP (HTTP):

Connects to befrugal.com (54.236.149.2:80)

TCP (HTTP):

Connects to a-0003.a-msedge.net (204.79.197.203:80)

Remove TheAnswerFinder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.