» 50ftwares-updater.exe
Overview
Analysis
File Details
Behaviors (2)
Programs (1)
Network (1)

50ftwares-updater.exe

50ftwares

Kimahri Software inc.

This adware uses the Crossrider platform to build and distribute this web browser advertising injection extension. Once installed in the browser it will hijack various browser settings (homepage, search) and may interfere and track behaviors as well as deliver ads. The application 50ftwares-updater.exe by Kimahri Software inc has been detected as adware by 3 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program 50ftwares by Luca Barberis which is a potentially unwanted software program. It is built using the Crossrider browser extension toolkit; the Updater component is used to dynamically connects to the Crossrider API (update.srvstatsdata.com/.../{CAMP_ID}/update.json) and download additional code in order to automatically update Luca Barberis extension/toolbar. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

Luca Barberis (signed by Kimahri Software inc.)

Product:

50ftwares

Description:

50ftwares exe

Version:

1000.1000.1000.1000

MD5:

98f7aee4f96f05d97e02f3f2d111951d

SHA-1:

48d6274d786c73619acf91bf23fa66136773ec28

SHA-256:

88b08493c157e8f472f17abc4e021f6d894504c6d9641ebb4bd5cfdfcb24f695

Scanner detections:

3 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform. This is the updater mechanism that runs in the background as a scheduled task.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Kimahri Software inc..

Analysis date:

5/1/2024 4:05:12 AM UTC (today)

Scan engine

Detection

Engine version

Boost by Reason

Optional.Task.KimahriSoftwareinc.R

188163

herdProtect (fuzzy)

variant of hdvid codec v1-updater.exe (Adware)

2013.12.20.15

Reason Heuristics

PUP.Crossrider.Task.KimahriSoftwareinc.R

14.2.26.9

File size:

357.9 KB (366,440 bytes)

Product version:

1000.1000.1000.1000

Original file name:

50ftwares.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\50ftwares\50ftwares-updater.exe

Digital Signature

Signed by:

Kimahri Software inc.

Authority:

COMODO CA Limited

Valid from:

3/6/2013 4:00:00 PM

Valid to:

3/6/2016 3:59:59 PM

Subject:

CN=Kimahri Software inc., O=Kimahri Software inc., STREET=666 Sherbrooke Rue w, L=Montreal, S=Quebec, PostalCode=H3A 1E7, C=CA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00A1BB8569950C0B2080A11A0E2F618B33

File PE Metadata

Compilation timestamp:

6/18/2013 8:18:11 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:+vKhcb2v/3ORHjgwkG//u3CWTzRwIPjVgYlj6ecJNpTB19ve:bO2v/3ONjgwkG//u3CWiojVgAopTjQ

Entry address:

0x2DD64

Entry point:

E8, 2F, AA, 00, 00, E9, 89, FE, FF, FF, CC, CC, 57, 56, 53, 33, FF, 8B, 44, 24, 14, 0B, C0, 7D, 14, 47, 8B, 54, 24, 10, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 14, 89, 54, 24, 10, 8B, 44, 24, 1C, 0B, C0, 7D, 14, 47, 8B, 54, 24, 18, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 1C, 89, 54, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 18, 8B, 44, 24, 14, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 10, F7, F1, 8B, D3, EB, 41, 8B, D8, 8B, 4C, 24, 18, 8B, 54, 24, 14, 8B, 44, 24, 10, D1, EB, D1, D9, D1, EA, D1, D8, 0B, DB, 75, F4, F7... 
[+]

Entropy:

6.5244

Code size:

274.5 KB (281,088 bytes)

2 Scheduled Tasks

Task name:

50ftwares-updater

Trigger:

Logon (Runs on logon)

Task name:

50ftwares-updater

Trigger:

Logon (Runs on logon)

Action:

50ftwares-updater.exe \runupdater \agentregpath='50ftwares' \appid=35526

The file 50ftwares-updater.exe has been discovered within the following program.

50ftwares by Luca Barberis

The download manager co-bundles a number of potentially unwanted toolbars including Babylon Toolbar, Funmoods Toolbar, DealPly and GiantSavings through InstallCore.

50ftwares.com

74% remove it

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to lb-212-222.above.com (103.224.212.222:80)

Remove 50ftwares-updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.