» utility.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Downloads (2)
Network (3)

utility.exe

City Center Games (Extreme White Limited)

The application utility.exe by City Center Games (Extreme White Limited) has been detected as adware by 23 anti-malware scanners. This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler named Crossbrowse triggered to execute each time a user logs in. This file is typically installed with the program Crossbrowse by CLARALABSOFTWARE which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

utility.exe

Publisher:

City Center Games (Extreme White Limited) (signed and verified)

Version:

106.0.0.0

MD5:

3e8aed106151ca9c0ef93c623ecd1ba4

SHA-1:

27040ae51d25e018ca9838f1c0864c947b58c616

SHA-256:

516c3380409e2c0e2a68cd376d2f4911fb1319353f10a00927cc73029081f041

Scanner detections:

23 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

12/23/2024 9:59:04 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Toolbar.CrossRider

7.1.1

AhnLab V3 Security

PUP/Win32.CrossRider

2015.06.18

Avira AntiVirus

ADWARE/CrossRider.Gen7

8.3.1.6

AVG

Win32/DH{gRJlfRMDICIlV04}

2016.0.3040

Baidu Antivirus

Adware.Win32.CrossAd

4.0.3.15722

Dr.Web

Trojan.Crossrider1.31292

9.0.1.0203

ESET NOD32

Win32/Toolbar.CrossRider.CN potentially unwanted (variant)

9.11801

Fortinet FortiGate

W32/AppRider.CN

7/22/2015

G Data

Win32.Application.Agent.IIJFMO

15.7.25

herdProtect (fuzzy)

variant of mini_installer.exe

2015.8.23.13

K7 AntiVirus

Unwanted-Program

13.206.16562

Kaspersky

HEUR:Trojan-Downloader.Win32.Generic

14.0.0.1695

Malwarebytes

PUP.Optional.Crossbrowse.C

v2015.07.22.10

McAfee

Artemis!3E8AED106151

5600.6696

NANO AntiVirus

Trojan.Win32.DownLoader14.dtggwm

0.30.24.2487

Panda Antivirus

Trj/Genetic.gen

15.07.22.10

Qihoo 360 Security

HEUR/QVM10.1.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.ExtremeWhite.installCore (M)

15.7.22.22

SUPERAntiSpyware

Adware.Downloader/Variant

9737

Trend Micro

TROJ_GEN.R08NC0EG215

10.465.22

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.4

VIPRE Antivirus

Crossrider

41208

Zillya! Antivirus

Adware.CrossRider.Win32.12468

2.0.0.2289

File size:

1.9 MB (1,957,976 bytes)

Product version:

106.0.0.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\crossbrowse\crossbrowse\application\utility.exe

Digital Signature

Signed by:

City Center Games (Extreme White Limited)

Authority:

COMODO CA Limited

Valid from:

4/14/2015 7:30:00 PM

Valid to:

4/14/2016 7:29:59 PM

Subject:

CN=City Center Games (Extreme White Limited), O=City Center Games (Extreme White Limited), STREET=Tassou Papadopulu 6 (flat/office 22), L=Nicosia, S=Agios Dometios, PostalCode=2373, C=CY

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00808728FFBF020E8929813B59AA2EC529

File PE Metadata

Compilation timestamp:

6/17/2015 5:25:53 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

49152:MfecA1+cHOEBmaByDTcB1kTapSUdN6KToXIu8QHFBC8FT8:KHA1XXBy3cPoe

Entry address:

0x129D2E

Entry point:

E8, 48, 11, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 24, 8E, 5C, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 48, CE, 5B, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, 24, 8E, 5C, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01... 
[+]

Code size:

1.3 MB (1,402,368 bytes)

Scheduled Task

Task name:

Crossbrowse

Trigger:

Logon (Runs on logon)

The file utility.exe has been discovered within the following program.

Crossbrowse by CLARALABSOFTWARE

87% remove it

The file utility.exe has been seen being distributed by the following 2 URLs.

http://download.rgbdomsrv.com/crcb/107/.../installer.exe

http://download.ewebdomrec.com/crcb/107/.../installer.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to lb-182-252.above.com (103.224.182.252:80)

TCP (HTTP):

Connects to ec2-75-101-162-66.compute-1.amazonaws.com (75.101.162.66:80)

TCP (HTTP):

Connects to ec2-54-243-117-208.compute-1.amazonaws.com (54.243.117.208:80)

Remove utility.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.