home

air44bb.exe

Web Bar Media

The application air44bb.exe by Web Bar Media has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is also typically executed from the user's temporary directory.
Publisher:
Web Bar Media  (signed and verified)

MD5:
fd29beed650d1eeb6fa64e58e07662df

SHA-1:
26da40f1ba9f0e1419a8d5a6f96e735fa3556db0

SHA-256:
e14ba5c04021c0c1a96ec5130be234a06fbfa245b3627a55b67e54b8fb32f7ca

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/4/2024 2:03:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WebBarMedia (M)
15.12.20.12

File size:
83 KB (84,976 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\air44bb.exe

Digital Signature
Signed by:
Web Bar Media

Authority:
DigiCert Inc

Valid from:
1/30/2014 7:00:00 PM

Valid to:
2/5/2015 7:00:00 AM

Subject:
CN=Web Bar Media, O=Web Bar Media, L=Victoria, S=British Columbia, C=CA

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
044224073D1C7BCC8763D980B58EA97E

File PE Metadata
Compilation timestamp:
8/13/2014 6:02:39 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
1536:/PO04M+r7LwW4INdzRrmzc8ursWjcd2hNEK8C7G:3OtHMj4zGdGNlRq

Entry address:
0x15C6

Entry point:
E8, 6B, 16, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, FF, 15, 3C, C0, 40, 00, 6A, 01, A3, 24, 34, 41, 00, E8, AF, 1D, 00, 00, FF, 75, 08, E8, 4F, 1B, 00, 00, 83, 3D, 24, 34, 41, 00, 00, 59, 59, 75, 08, 6A, 01, E8, 95, 1D, 00, 00, 59, 68, 09, 04, 00, C0, E8, 1D, 1B, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 5B, 9F, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, 08, 32, 41, 00, 89, 0D, 04, 32, 41, 00, 89, 15, 00, 32, 41, 00, 89, 1D, FC, 31, 41, 00, 89, 35, F8, 31, 41, 00, 89, 3D, F4...
 
[+]

Entropy:
6.1575

Code size:
41.5 KB (42,496 bytes)

Remove air44bb.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.