» 4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe

Freeven pro

Kimahri Software inc.

This adware uses the Crossrider platform to build and distribute this web browser advertising injection extension. Once installed in the browser it will hijack various browser settings (homepage, search) and may interfere and track behaviors as well as deliver ads. The application 4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe by Kimahri Software inc has been detected as adware by 28 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Freeven pro by Kimahri Software inc. which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

Publisher:

Freeven (signed by Kimahri Software inc.)

Product:

Freeven pro

Description:

Freeven pro exe

Version:

1000.1000.1000.1000

MD5:

be163c7dea67979e6a09cc2e5f6223c0

SHA-1:

d910682e72f3e326c05dc82fc1af6db867545af6

SHA-256:

5e13fecd47173fc1131301a97527dc73a21b42cc8248b09df427e6f947ae2618

Scanner detections:

28 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Analysis date:

4/26/2024 6:52:01 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Adware.Plush.1

669

AhnLab V3 Security

Win-PUP/CrossRider

2014.12.06

Avira AntiVirus

Adware/CrossRider.A.1611

7.11.145.108

AVG

Generic_s

2016.0.3147

Baidu Antivirus

Adware.Win32.CrossRider

4.0.3.1547

Bitdefender

Gen:Adware.Plush.1

1.0.20.485

Comodo Security

ApplicUnwnt

20284

Dr.Web

Trojan.Crossrider.30883

9.0.1.097

Emsisoft Anti-Malware

Gen:Adware.Plush

8.15.07.10.12

ESET NOD32

Win32/Toolbar.CrossRider.AD (variant)

9.9727

Fortinet FortiGate

Riskware/Toolbar_CrossRider

4/7/2015

F-Prot

W32/A-6583813c

v6.4.7.1.166

F-Secure

Gen:Adware.Plush.1

11.2015-10-07_6

G Data

Gen:Adware.Plush

15.4.24

herdProtect (fuzzy)

variant of 672625e8-02d8-41e5-8655-b69342a4c332-4.exe (Adware)

2015.7.10.12

K7 AntiVirus

Unwanted-Program

13.186.14254

Kaspersky

not-a-virus:WebToolbar.Win32.CroRi

14.0.0.2228

Malwarebytes

PUP.Optional.PlusHD.A

v2015.04.07.07

McAfee

Adware-CrossR

5600.6803

MicroWorld eScan

Gen:Adware.Plush.1

16.0.0.291

NANO AntiVirus

Trojan.Win32.Crossrider.deqwwi

0.28.6.63850

Panda Antivirus

PUP/PlusHD

15.04.07.07

Qihoo 360 Security

Win32/Virus.Adware.01e

1.0.0.1015

Reason Heuristics

Adware.Crossrider.Task.Brightcircle

15.4.7.3

Trend Micro House Call

TROJ_GEN.R0C1C0EJP14

7.2.97

Trend Micro

TROJ_GEN.R0C1C0EJP14

10.465.07

VIPRE Antivirus

Crossrider

28622

Zillya! Antivirus

Adware.CroRi.Win32.747

2.0.0.1999

File size:

782.4 KB (801,128 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Freeven pro.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\freeven pro\4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe

Digital Signature

Signed by:

Kimahri Software inc.

Authority:

COMODO CA Limited

Valid from:

3/7/2013 11:00:00 AM

Valid to:

3/7/2016 10:59:59 AM

Subject:

CN=Kimahri Software inc., O=Kimahri Software inc., STREET=666 Sherbrooke Rue w, L=Montreal, S=Quebec, PostalCode=H3A 1E7, C=CA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00A1BB8569950C0B2080A11A0E2F618B33

File PE Metadata

Compilation timestamp:

4/25/2014 1:20:32 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:IGvxE2bb/CSoo87BiIZFJ5D18xT6Q/jAzAz5WnUdSYGdwcpTdd:IGvWeuRXvJ5D18xT6kgnkBuTr

Entry address:

0x825DF

Entry point:

E8, 44, EC, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00, FF, 00, 74, 13, A9, 00, 00, 00, FF, 74, 02, EB, CD, 8D, 41, FF, 8B, 4C, 24, 04, 2B, C1, C3, 8D, 41... 
[+]

Entropy:

6.5395

Code size:

635 KB (650,240 bytes)

Scheduled Task

Task name:

4f687e4b-4bce-416b-af60-c0699d75fa82-4

Trigger:

Logon (Runs on logon)

The file 4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe has been discovered within the following program.

Freeven pro by Kimahri Software inc.

This is an ad-supported (adware) web browser extension that may inject advertising in the user's web browser in the form of banner ads, text hyperlinks as well as popups.

crossrider.com/pages/extension_eula

80% remove it

Remove 4f687e4b-4bce-416b-af60-c0699d75fa82-4.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.