home

zaxargamebrowser.exe

ZAXAR LTD

The application zaxargamebrowser.exe by ZAXAR has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from zaxargames.com and multiple other hosts.
Publisher:
ZAXAR LTD  (signed and verified)

MD5:
fd6e30b879ea2347e1124376b5f2d1cf

SHA-1:
b8e9c2c9b4a763462c547f0d003ff041ec91d10b

SHA-256:
0fc1bf489b9f257881b13b719c55ecc3836ffe81a20eb495f29c4c595d4f2432

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/15/2024 3:16:03 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ZAXAR.Q
14.4.13.22

File size:
1.2 MB (1,238,312 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\zaxar\zaxargamebrowser.exe

Digital Signature
Signed by:
ZAXAR LTD

Authority:
VeriSign, Inc.

Valid from:
10/9/2013 6:00:00 AM

Valid to:
11/9/2015 5:59:59 AM

Subject:
CN=ZAXAR LTD, OU=IT, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ZAXAR LTD, L=Limassol, S=Limassol, C=CY

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5B3FCBE6F8071E9035B8810DD3B0F143

File PE Metadata
Compilation timestamp:
11/7/2013 6:13:58 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:ikP802HI5HInVBV2oZWIRVm+sP4UXw726OXU+uMhyQEkgIkyeSWxV5Qbh:ia802ugVv2ocIRVm+sPHXwQVyFfI+ch

Entry address:
0x4DE99

Entry point:
E8, 85, 04, 00, 00, E9, 63, FD, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 38, C7, 4F, 00, 89, 0D, 34, C7, 4F, 00, 89, 15, 30, C7, 4F, 00, 89, 1D, 2C, C7, 4F, 00, 89, 35, 28, C7, 4F, 00, 89, 3D, 24, C7, 4F, 00, 66, 8C, 15, 50, C7, 4F, 00, 66, 8C, 0D, 44, C7, 4F, 00, 66, 8C, 1D, 20, C7, 4F, 00, 66, 8C, 05, 1C, C7, 4F, 00, 66, 8C, 25, 18, C7, 4F, 00, 66, 8C, 2D, 14, C7, 4F, 00, 9C, 8F, 05, 48, C7, 4F, 00, 8B, 45, 00, A3, 3C, C7, 4F, 00, 8B, 45, 04, A3, 40, C7, 4F, 00, 8D, 45, 08, A3, 4C, C7, 4F...
 
[+]

Code size:
369.5 KB (378,368 bytes)

The file zaxargamebrowser.exe has been seen being distributed by the following 3 URLs.

http://zaxargames.com/client/.../ZaxarGameBrowser.exe

http://zxrmedia.com/client/.../ZaxarGameBrowser.exe

http://zaxargames.com/client/.../ZaxarGameBrowser.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to srv166-156-240-87.vk.com  (87.240.156.166:80)

TCP (HTTP):
Connects to mystatic2.i.mail.ru  (185.5.137.202:80)

TCP (HTTP):
Connects to mc.yandex.ru  (93.158.134.119:80)

TCP (HTTP):
Connects to lb-in-f101.1e100.net  (173.194.71.101:80)

TCP (HTTP):
Connects to la-in-f157.1e100.net  (74.125.143.157:80)

TCP (HTTP SSL):
Connects to edge-star-shv-05-ams2.facebook.com  (31.13.64.81:443)

TCP (HTTP):
Connects to beacon-2.newrelic.com  (50.31.164.172:80)

TCP (HTTP):
Connects to a92-123-151-139.deploy.akamaitechnologies.com  (92.123.151.139:80)

TCP (HTTP SSL):
Connects to a84-53-166-110.deploy.akamaitechnologies.com  (84.53.166.110:443)

TCP (HTTP):
Connects to a23-14-93-151.deploy.static.akamaitechnologies.com  (23.14.93.151:80)

Remove zaxargamebrowser.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.