» updater.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

updater.exe

Amazon Browser Settings

Browser Distribution Services Inc.

The executable updater.exe has been detected as malware by 1 anti-virus scanner. It runs as a scheduled task under the Windows Task Scheduler triggered daily at a specified time. Additionally, the file is typically installed by a number of programs including Amazon Assistant by Amazon and Amazon Search by Amazon.

File name:

updater.exe

Publisher:

Distromatic (signed by Browser Distribution Services Inc.)

Product:

Amazon Browser Settings

Version:

1.2.1.1414

MD5:

659e281bd04de1391f64519e7262e986

SHA-1:

bfc90780a7ce8fc85967dbf1473575e7a193eb98

SHA-256:

be2180ace74988b24f669e1f64a578ae513433709a3dda43f16b88f31a2baa6c

Scanner detections:

1 / 68

Status:

Malware

Analysis date:

11/5/2024 8:05:30 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP (M)

17.3.13.10

File size:

3.3 MB (3,509,352 bytes)

Product version:

3.0.5.1338-fc43e392

Browser Distribution Services

Original file name:

distro-silent-installer.exe

File type:

Executable application (Win32 EXE)

Language:

English (Wielka Brytania)

Common path:

C:\Program Files\amazon browser settings\updater.exe

Digital Signature

Signed by:

Browser Distribution Services Inc.

Authority:

Symantec Corporation

Valid from:

12/18/2015 1:00:00 AM

Valid to:

12/18/2017 12:59:59 AM

Subject:

CN=Browser Distribution Services Inc., O=Browser Distribution Services Inc., L=Las Vegas, S=Nevada, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

0E7157187A3C9C51E5535C5D49605D0C

File PE Metadata

Compilation timestamp:

3/14/2016 2:38:56 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

14.0

Entry address:

0x4554A0

Entry point:

60, BE, 00, E0, 72, 00, 8D, BE, 00, 30, CD, FF, C7, 87, A0, DB, 44, 00, FF, 2F, 04, 70, 57, EB, 11, 90, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46... 
[+]

Code size:

1.2 MB (1,212,416 bytes)

Scheduled Task

Task name:

DistromaticSearchProtect-hourly

Trigger:

Daily (Runs daily at 12:33)

Description:

Keeps browser search settings up to date and makes sure they are not changed by malware.

The file updater.exe has been discovered within the following programs.

Amazon Assistant by Amazon

www.amazon.com/gp/BIT/theamazonapp

About 8% of users remove it

Amazon Search by Amazon

About 2% of users remove it

Remove updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.