10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5.exe

SensePlus

Armageddon Labs (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application 10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5.exe by Armageddon Labs (BrightCircle Investments Limited) has been detected as adware by 16 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program SensePlus by BrightCircle Investments Limited which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Object Browser  (signed by Armageddon Labs (BrightCircle Investments Limited))

Product:
SensePlus

Description:
SensePlus exe

Version:
1000.1000.1000.1000

MD5:
6614753e7371f8e106fd5ec11b056e54

SHA-1:
f49a6719ad4ff93f9188fd224090948529450768

SHA-256:
86952a821d6b2a90e57823f0ca9b0d8b627f5c8ff91e0cc0e09129cb5ae22c5f

Scanner detections:
16 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
4/24/2024 4:38:47 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Application.Heur.dv1@kabL3YeO
6213306

Avira AntiVirus
ADWARE/CrossRider.Gen4
7.11.197.30

avast!
Win32:Malware-gen
141214-1

AVG
Generic
2015.0.3253

Bitdefender
Gen:Application.Heur.dv1@kabL3YeO
1.0.20.1780

Emsisoft Anti-Malware
Gen:Application.Heur.dv1@kabL3YeO
9.0.0.4668

ESET NOD32
Win32/Toolbar.CrossRider.BM potentially unwanted application
7.0.302.0

F-Secure
Riskware.Gen:Application.Heur.dv1@kabL3YeO
5.13.68

G Data
Gen:Application.Heur.dv1@kabL3YeO
14.12.24

IKARUS anti.virus
Trojan.GoogUpdate
t3scan.1.8.5.0

Kaspersky
not-a-virus:WebToolbar.Win32.CrossRider
15.0.0.543

Malwarebytes
PUP.Optional.SensePlus.A
v2014.12.22.05

MicroWorld eScan
Gen:Application.Heur.dv1@kabL3YeO
15.0.0.1068

Norman
Gen:Application.Heur.dv1@kabL3YeO
04.12.2014 14:30:06

Panda Antivirus
Generic Suspicious
14.12.22.05

Reason Heuristics
PUP.Crossrider.Task.g
15.1.4.17

File size:
1.1 MB (1,114,080 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
SensePlus.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\senseplus\10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
12/1/2014 12:00:00 AM

Valid to:
12/1/2015 11:59:59 PM

Subject:
CN=Armageddon Labs (BrightCircle Investments Limited), O=Armageddon Labs (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C5692390E715129E144F950D09DA6E8A

File PE Metadata
Compilation timestamp:
12/21/2014 11:33:30 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:0G7cMAQTAb9YQFxZ3L2rw82Ihm6K/UNLWCh+Y4PepShSWTpk:qGMp7ArNthbRWChpcepShSWT+

Entry address:
0xA131F

Entry point:
E8, 73, F8, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 0C, 57, 85, C9, 0F, 84, 92, 00, 00, 00, 56, 53, 8B, D9, 8B, 74, 24, 14, F7, C6, 03, 00, 00, 00, 8B, 7C, 24, 10, 75, 0B, C1, E9, 02, 0F, 85, 85, 00, 00, 00, EB, 27, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 83, E9, 01, 74, 2B, 84, C0, 74, 2F, F7, C6, 03, 00, 00, 00, 75, E5, 8B, D9, C1, E9, 02, 75, 61, 83, E3, 03, 74, 13, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 84, C0, 74, 37, 83, EB, 01, 75, ED, 8B, 44, 24, 10, 5B, 5E, 5F, C3, F7...
 
[+]

Code size:
793.5 KB (812,544 bytes)

Scheduled Task
Task name:
10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5

Trigger:
Logon (Runs on logon)


The file 10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5.exe has been discovered within the following program.

SensePlus  by BrightCircle Investments Limited
Publisher's description - “SensePlus is an online shopping tool that combines cash back, discounts and online coupons. Our browser app uses tools to look at your browsing activity to make sure we notify you with coupons and offers that are relevant to you.”
82% remove it
 
Powered by Should I Remove It?

Remove 10e4762b-2d6a-487c-8ddb-0e02c73e3e30-5.exe - Powered by Reason Core Security