home

uran.exe

Uran

Limited Liability Company Ucoz Media

The application uran.exe by Limited Liability Company Ucoz Media has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address dev99.ucoz.net on port 80 using the HTTP protocol.
Publisher:
uCoz Media LLC and Chromium Authors  (signed by Limited Liability Company Ucoz Media)

Product:
Uran

Version:
35.0.1916.153

MD5:
8510d680110b23bf4e249320997b22fb

SHA-1:
1b61b7bcb0013a2a0053321556b082f17ddbc15c

SHA-256:
3350d904324d334137bdbaa5976e65914f655f4759b6561962b3abb02a7ae505

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/25/2024 1:45:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.LimitedLiabilityCompanyUcozMedia
15.3.20.18

File size:
752.5 KB (770,512 bytes)

Product version:
35.0.1916.153

Copyright:
Copyright 2013 The Chromium Authors. All rights reserved.

Original file name:
chrome.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\ucozmedia\uran\application\uran.exe

Digital Signature
Signed by:
Limited Liability Company Ucoz Media

Authority:
GlobalSign nv-sa

Valid from:
1/29/2014 7:05:40 PM

Valid to:
4/17/2015 11:17:49 PM

Subject:
E=alexzander@ucoz.com, CN=Limited Liability Company Ucoz Media, O=Limited Liability Company Ucoz Media, C=RU

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112151EB6FD5329EE6DCAEC03C522243C994

File PE Metadata
Compilation timestamp:
6/23/2014 8:45:22 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:TssGkc3fsnVBRTm2OApceTpMbDI6Ob++lDZKU2zIKZLJYQiVoILjxl1ifOjbiWFy:TsKqs9Te1c++lgUiZ0Ljxx/Ly

Entry address:
0x4526F

Entry point:
E8, 40, C7, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 8B, 45, 08, 99, F7, 7D, 0C, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, 55, 8B, EC, FF, 15, 44, 21, 46, 00, 6A, 01, A3, B4, 59, 49, 00, E8, 53, 8A, 00, 00, FF, 75, 08, E8, 12, 5A, 00, 00, 83, 3D, B4, 59, 49, 00, 00, 59, 59, 75, 08, 6A, 01, E8...
 
[+]

Code size:
387.5 KB (396,800 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to dev.ucoz.net  (195.216.243.130:80)

TCP (HTTP):
Connects to dev99.ucoz.net  (217.199.217.99:80)

TCP (HTTP SSL):
Connects to yandex.ru  (5.255.255.55:443)

TCP (HTTP SSL):
Connects to ec2-54-225-90-246.compute-1.amazonaws.com  (54.225.90.246:443)

TCP (HTTP SSL):
Connects to mc.yandex.ru  (87.250.251.119:443)

TCP (HTTP):
Connects to dev44.ucoz.net  (217.199.217.44:80)

TCP (HTTP SSL):
Connects to avatars.mds.yandex.net  (87.250.247.183:443)

TCP (HTTP SSL):
Connects to video-tub.yandex.ru  (213.180.193.101:443)

TCP (HTTP SSL):
Connects to favicon.yandex.net  (213.180.204.36:443)

TCP (HTTP SSL):
Connects to avatars.yandex.net  (87.250.247.191:443)

TCP (HTTP):
Connects to host45.rax.ru  (88.212.196.75:80)

Remove uran.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.