» apisupport.dll
Overview
Analysis
File Details
Behaviors (1)
Downloads (9)

apisupport.dll

APISupport

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The module apisupport.dll by ClientConnect has been detected as adware by 11 anti-malware scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘APISupport’. The file has been seen being downloaded from storage.conduit.com and multiple other hosts.

File name:

apisupport.dll

Publisher:

ClientConnect Ltd. (signed by ClientConnect LTD)

Product:

APISupport

Version:

3.0.0.40

MD5:

dd1e0296b9a3fe5c6446c00dd073075c

SHA-1:

c347e76b52f6c704d1c36232a4277aa831011613

Scanner detections:

11 / 68

Status:

Adware

Explanation:

Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:

5/18/2024 5:47:36 AM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

PUA.Win32.Conduit.bSearchProtect

4.0.3.14825

ESET NOD32

Win32/Conduit.SearchProtect (variant)

8.10310

IKARUS anti.virus

PUA.ClientConnect

t3scan.1.7.5.0

Malwarebytes

PUP.Optional.ClientConnect

v2014.08.25.09

Reason Heuristics

PUP.ClientConnect.K

14.8.25.9

VIPRE Antivirus

Conduit

32526

File size:

1020.8 KB (1,045,312 bytes)

Product version:

3.0.0.40

Original file name:

APISupport

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Documents and Settings\{user}\Application data\tb\apisupport\apisupport.dll

Digital Signature

Signed by:

ClientConnect LTD

Authority:

VeriSign, Inc.

Valid from:

2/3/2014 5:30:00 AM

Valid to:

2/5/2016 5:29:59 AM

Subject:

CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Trovi TB, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

43E7738E282F77369A5A4C0ED31A3C9F

File PE Metadata

Compilation timestamp:

8/21/2014 11:43:44 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

24576:o/35GQ8yMSU1JcoEdzp36duhmJCIK2GFqBk9P:eYQdVd3gLGFqBk9P

Entry address:

0xA61F2

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 54, D5, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 70, F9, 0E, 10, E8, 6F, 60, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, A0, 62, 0F, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, F0, FD, 0C, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Entropy:

6.6264

Developed / compiled with:

Microsoft Visual C++

Code size:

819 KB (838,656 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

APISupport

Command:

"C:\Windows\System32\rundll32.exe" "C:\Documents and Settings\{user}\Application data\tb\apisupport\apisupport.dll",dllrunapisupport

The file apisupport.dll has been seen being distributed by the following 9 URLs.

http://storage.conduit.com/TBNewTabSupport/TBSupportAU/.../APISupport.dll

http://storage.stgbssint.com/TBNewTabSupport/TBSupportAU/.../APISupport.dll

http://storage.stgbssint.com/TBNewTabSupport/TBSupportAU/3.0.0.40/.../APISupport.dll

Remove apisupport.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.