home

web_bar_setup_2.0.5639.26751_3e16a056d.exe

Web Bar

Web Bar Media

The application web_bar_setup_2.0.5639.26751_3e16a056d.exe, “Web Bar Setup ” by Web Bar Media has been detected as adware by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cdn.chironexfleckerigray.com and multiple other hosts.
Publisher:
Web Bar Media   (signed by Web Bar Media)

Product:
Web Bar

Description:
Web Bar Setup

MD5:
0458d3307cd6fb810560327f5a428aca

SHA-1:
217d27e5c9d5fa452210d38e45ae2b6480994150

SHA-256:
f50002a97475992946b366ca89b36f426b1f310d935577560866545d254ff28b

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
11/27/2024 10:06:18 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Conduit.266
9.0.1.0167

Malwarebytes
PUP.Optional.WebBar.A
v2015.06.16.12

Reason Heuristics
PUP.Installer.WebBarMedia
15.6.15.20

File size:
2.1 MB (2,193,184 bytes)

Product version:
2.0.5639.26751

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\web_bar_setup_2.0.5639.26751_3e16a056d.exe

Digital Signature
Signed by:
Web Bar Media

Authority:
Symantec Corporation

Valid from:
2/6/2015 12:00:00 AM

Valid to:
2/6/2016 11:59:59 PM

Subject:
CN=Web Bar Media, O=Web Bar Media, L=Victoria, S=British Columbia, C=CA

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
0F7B7C7A3031BA614438E5A48FF24DD7

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:09Bsk7pft4ICHPHR4x8x1UGexmbcMGC3U3MlLVmczEdjJYIptpJMA:+Bzv8R4x8x1UGomgkUinzEdjlptMA

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9353

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file web_bar_setup_2.0.5639.26751_3e16a056d.exe has been seen being distributed by the following 2 URLs.

http://cdn.chironexfleckerigray.com/downloads/offers/.../Web_Bar_Setup_2.0.5639.26751_3e16a056d.exe

http://cdn.o400o.com/downloads/offers/.../Web_Bar_Setup_2.0.5639.26751_3e16a056d.exe

Remove web_bar_setup_2.0.5639.26751_3e16a056d.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.