» 9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7.exe
Overview
Analysis
File Details
Behaviors (1)
Network (2)

9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7.exe

CinemaPlus-3.2cV19.05

Digit Network (Extreme White Limited)

The application 9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7.exe, “CinemaPlus-3.2cV19.05 exe” by Digit Network (Extreme White Limited) has been detected as adware by 20 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. While running, it connects to the Internet address unknown.prolexic.com on port 80 using the HTTP protocol.

File name:

Publisher:

Cinema PlusV19.05 (signed by Digit Network (Extreme White Limited))

Product:

CinemaPlus-3.2cV19.05

Description:

CinemaPlus-3.2cV19.05 exe

Version:

1000.1000.1000.1000

MD5:

eba01154fd04d73887fd71a288ffcf6b

SHA-1:

4795158f4e738cf596485fff8cafb42d96f6f368

SHA-256:

949338efd3e33340bc3411edcac8be8e8cac84d4b464ec86162498e7400db2e0

Scanner detections:

20 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

4/24/2024 2:58:33 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Heur.av1@muDbeekO

626

AhnLab V3 Security

PUP/Win32.CrossRider

2015.05.20

Avira AntiVirus

ADWARE/CrossRider.Gen7

8.3.1.6

AVG

Toolbar.Crossrider.S

2016.0.3104

Baidu Antivirus

Adware.Win32.CrossAd

4.0.3.15520

Bitdefender

Gen:Application.Heur.av1@muDbeekO

1.0.20.700

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

Application.Win32.CrossRider.CK

22179

Dr.Web

Trojan.Crossrider1.31161

9.0.1.0142

ESET NOD32

Win32/Toolbar.CrossRider.CD potentially unwanted (variant)

9.11652

F-Secure

Gen:Application.Heur.av1@muDbeekO

11.2015-20-05_4

G Data

Gen:Application.Heur.av1@muDbeekO

15.5.25

Kaspersky

Trojan.NSIS.GoogUpdate

14.0.0.2002

Malwarebytes

PUP.Optional.CrossRider.A

v2015.05.20.02

MicroWorld eScan

Gen:Application.Heur.av1@muDbeekO

16.0.0.420

Reason Heuristics

Adware.Crossrider.ExtremeWhite

15.5.20.2

Rising Antivirus

PE:Malware.Adwapper!6.2370

23.00.65.15518

Sophos

Generic PUA HP

4.98

SUPERAntiSpyware

Adware.CrossRider/Variant

9865

VIPRE Antivirus

Threat.4150696

40420

File size:

1 MB (1,054,288 bytes)

Product version:

1000.1000.1000.1000

Original file name:

CinemaPlus-3.2cV19.05.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\cinemaplus-3.2cv19.05\9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7.exe

Digital Signature

Signed by:

Digit Network (Extreme White Limited)

Authority:

COMODO CA Limited

Valid from:

4/14/2015 9:00:00 PM

Valid to:

4/14/2016 8:59:59 PM

Subject:

CN=Digit Network (Extreme White Limited), O=Digit Network (Extreme White Limited), STREET=Tassou Papadopulu 6 (flat/office 22), L=Nicosia, S=Agios Dometios, PostalCode=2373, C=CY

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00F39F5E5096779B72822CF8381166A432

File PE Metadata

Compilation timestamp:

5/19/2015 4:05:07 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:8bdG2KuqGtyyxpfDFkqMaXx13I81VpSTdrJT6c:8bgFuqGtyWRDFoaJ1VpS5rJT6c

Entry address:

0x8845B

Entry point:

E8, B0, E6, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 0C, 57, 85, C9, 0F, 84, 92, 00, 00, 00, 56, 53, 8B, D9, 8B, 74, 24, 14, F7, C6, 03, 00, 00, 00, 8B, 7C, 24, 10, 75, 0B, C1, E9, 02, 0F, 85, 85, 00, 00, 00, EB, 27, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 83, E9, 01, 74, 2B, 84, C0, 74, 2F, F7, C6, 03, 00, 00, 00, 75, E5, 8B, D9, C1, E9, 02, 75, 61, 83, E3, 03, 74, 13, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 84, C0, 74, 37, 83, EB, 01, 75, ED, 8B, 44, 24, 10, 5B... 
[+]

Code size:

678 KB (694,272 bytes)

Scheduled Task

Task name:

9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7

Trigger:

Logon (Runs on logon)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to sage.parklogic.com (69.39.236.56:80)

TCP (HTTP):

Connects to unknown.prolexic.com (72.52.4.90:80)

Remove 9815939a-4f6d-40d6-b519-ba17cc0d74c4-1-7.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.