home

wsg_st2012_setup.exe

Crawler Toolbar

Crawler, LLC

The application wsg_st2012_setup.exe, “Crawler Toolbar Setup ” by Crawler has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from dnl.websecurityguard.com.
Publisher:
Crawler, LLC   (signed by Crawler, LLC)

Product:
Crawler Toolbar

Description:
Crawler Toolbar Setup

Version:
5.1.0.599

MD5:
2f1fd2cf3810aabe0ebad16f773c8ee6

SHA-1:
9851db1f160d2cee79d0bc014e6e8bb534303213

SHA-256:
a2227d6420b5c6afb97fe102fb08c7f5ade4a13e009becea40a9c3242632fb5b

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:37:33 AM UTC  (today)

Scan engine
Detection
Engine version

Clam AntiVirus
Win.Adware.PCFixSpeed
0.98/18355

Reason Heuristics
PUP.Installer.Crawler.Q
14.8.8.2

File size:
6.6 MB (6,948,752 bytes)

Product version:
5.1.0.599

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\wsg_st2012_setup.exe

Digital Signature
Signed by:
Crawler, LLC

Authority:
VeriSign, Inc.

Valid from:
12/9/2010 9:00:00 PM

Valid to:
12/11/2013 8:59:59 PM

Subject:
CN="Crawler, LLC", OU=IT, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Crawler, LLC", L=Boca Raton, S=Florida, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1535EDA3C8F2FED30D4497572760F240

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:TB0mPawSBKhM9yqi5w2OeDF/KVW+7n1hsgQyQNoBK0e2U3:TBjCwSBVDGOeZyVT7nj/xQNoB9e73

Entry address:
0xC1C0

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, C8, C0, 40, 00, E8, 60, 86, FF, FF, 33, C0, 55, 68, 85, C8, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 41, C8, 40, 00, 64, FF, 32, 64, 89, 22, A1, 60, E6, 40, 00, E8, 5E, FD, FF, FF, E8, C9, F8, FF, FF, 8D, 55, EC, 33, C0, E8, 93, CA, FF, FF, 8B, 55, EC, B8, 8C, F0, 40, 00, E8, 0A, 77, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 8C, F0, 40, 00, B2, 01...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
46.5 KB (47,616 bytes)

The file wsg_st2012_setup.exe has been seen being distributed by the following URL.

http://dnl.websecurityguard.com/Dnl/config/.../WSG_ST2012_Setup.exe

Remove wsg_st2012_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.