home

toolbarremover.exe

APN LLC

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application toolbarremover.exe, “Utility to cleanup application(s) when uninstallation fails.” by APN has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from apnmedia.ask.com.
Publisher:
Ask Partner Network  (signed by APN LLC)

Description:
Utility to cleanup application(s) when uninstallation fails.

Version:
2.2.0.1

MD5:
936948784a125f2b3c702dc6cf30215f

SHA-1:
3416fd8ba2c9b2c282c9bcf039aae7794b881b13

SHA-256:
a78c78a4d9967454e449b727861c2251dc01980a4b13ab0ab59058322afe8073

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/27/2024 2:32:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Ask.APN (M)
15.7.29.8

File size:
256.4 KB (262,552 bytes)

Product version:
2.2.0.1

Copyright:
Copyright: APN LLC (c). All rights reserved.

Original file name:
ApnRemover.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\toolbarremover.exe

Digital Signature
Signed by:
APN LLC

Authority:
VeriSign, Inc.

Valid from:
2/26/2015 8:00:00 AM

Valid to:
5/28/2018 7:59:59 AM

Subject:
CN=APN LLC, O=APN LLC, L=Oakland, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
74BAC30967391B08242D79F7F79449E2

File PE Metadata
Compilation timestamp:
7/18/2015 6:37:49 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:p+KI6kL8EU38MBUPo9BMWLpmkZm4Mk4+Q+:oKSNMBUGMWtmk04MWQ+

Entry address:
0x138AD

Entry point:
E8, 8E, 46, 00, 00, E9, 79, FE, FF, FF, 3B, 0D, C0, 2E, 43, 00, 75, 02, F3, C3, E9, 10, 47, 00, 00, 8B, FF, 51, C7, 01, 00, AA, 42, 00, E8, 08, 48, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 0E, 15, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, 44, 48, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 51, 53, 56, 57, FF, 35, A8, 7E, 43, 00, E8, C3, 40, 00, 00, FF, 35...
 
[+]

Entropy:
6.1614

Code size:
154 KB (157,696 bytes)

The file toolbarremover.exe has been seen being distributed by the following URL.

http://apnmedia.ask.com/media/toolbar/.../ToolbarRemover.exe

Remove toolbarremover.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.