» utility.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Downloads (2)
Network (1)

utility.exe

City Center Games (Extreme White Limited)

The application utility.exe by City Center Games (Extreme White Limited) has been detected as adware by 12 anti-malware scanners. This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler named Crossbrowse triggered to execute each time a user logs in. This file is typically installed with the program Crossbrowse by CLARALABSOFTWARE which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

utility.exe

Publisher:

City Center Games (Extreme White Limited) (signed and verified)

Version:

105.0.0.0

MD5:

dd07d92ad7d495f7a9c8b8d9f46bbbf4

SHA-1:

1141007d8530ab26d60822ad908b4bc1dbe1bd8e

SHA-256:

23588313aba7386dc90562c7e744d94a072d4311673f2baa25bc6d153cbfafcc

Scanner detections:

12 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

11/23/2024 4:53:07 PM UTC (today)

Scan engine

Detection

Engine version

AVG

Win32/DH{gRITfWUDICIlZABXTg}

2016.0.3116

Dr.Web

Trojan.Crossrider1.29263

9.0.1.0127

ESET NOD32

Win32/Toolbar.CrossRider.CN potentially unwanted (variant)

9.11599

herdProtect (fuzzy)

variant of 3611.exe (Adware)

2015.8.5.22

K7 AntiVirus

Unwanted-Program

13.203.15838

Kaspersky

HEUR:Trojan-Downloader.Win32.Generic

14.0.0.2076

Malwarebytes

PUP.Optional.CrossBrowse

v2015.05.14.08

Qihoo 360 Security

HEUR/QVM10.1.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.installCore.CityCenterGamesExtremeWhiteLimited

15.5.8.23

Sophos

AppRider

4.98

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

Crossrider

40034

File size:

1.8 MB (1,893,976 bytes)

Product version:

105.0.0.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\crossbrowse\crossbrowse\application\utility.exe

Digital Signature

Signed by:

City Center Games (Extreme White Limited)

Authority:

COMODO CA Limited

Valid from:

4/15/2015 2:00:00 AM

Valid to:

4/15/2016 1:59:59 AM

Subject:

CN=City Center Games (Extreme White Limited), O=City Center Games (Extreme White Limited), STREET=Tassou Papadopulu 6 (flat/office 22), L=Nicosia, S=Agios Dometios, PostalCode=2373, C=CY

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00808728FFBF020E8929813B59AA2EC529

File PE Metadata

Compilation timestamp:

4/30/2015 4:32:26 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

49152:1Q+7a9bjH7hdgXSfi2BXXrT7pSy9fVGRl2YxJ5iaN46p:C0a9NWSfBB4R

Entry address:

0x122990

Entry point:

E8, 2B, 11, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, C4, 9D, 5B, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 48, DE, 5A, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, C4, 9D, 5B, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01, 00, 00... 
[+]

Code size:

1.3 MB (1,365,504 bytes)

Scheduled Task

Task name:

Crossbrowse

Trigger:

Logon (Runs on logon)

The file utility.exe has been discovered within the following program.

Crossbrowse by CLARALABSOFTWARE

87% remove it

The file utility.exe has been seen being distributed by the following 2 URLs.

http://sub.sababaishen.com/installers/bi_downloader/.../setup.exe

http://dl.ourstaticdatastorage.com/69/all/cp/.../setup.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to lb-182-252.above.com (103.224.182.252:80)

Remove utility.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.