altonavTray.exe

altonav

This is part of the Sendori web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application altonavTray.exe, “altonav Notification Icon” by altonav has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Altonav Tray’. This file is typically installed with the program Altonav.
Publisher:
altonav  (signed and verified)

Product:
altonav

Description:
altonav Notification Icon

Version:
3.0.1

MD5:
cacd3c2745ee19b3a8140fe8aca1089f

SHA-1:
57130ff6f5d507071d46e3f75d9663195d52054f

SHA-256:
ad6ab66f2e639619194cd468df009cc7e29695253060827f0fef1e0ac0db245a

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/30/2024 12:40:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Sendori (M)
16.10.23.15

File size:
90.2 KB (92,392 bytes)

Product version:
3.0.1

Copyright:
© Dynamic Network Services, Inc.

Trademarks:
Dyn (sm)

Original file name:
altonavTray.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\altonav\altonavtray.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
8/18/2014 5:30:00 AM

Valid to:
8/18/2017 5:29:59 AM

Subject:
CN=altonav, O=altonav, L=San Leandro, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
10E276E0F710E2E93163C74E8E2FD691

File PE Metadata
Compilation timestamp:
2/6/2015 11:11:41 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:25/58hcB1RGHxhP5tvBH6KySi5khZSxI5P77h2JB/hqZC8:2jZGvYKySdZSx6PHhwBkZ5

Entry address:
0x540B

Entry point:
E8, 21, 23, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 7D, 08, 00, 74, 2D, FF, 75, 08, 6A, 00, FF, 35, 10, 4A, 41, 00, FF, 15, 1C, E1, 40, 00, 85, C0, 75, 18, 56, E8, BD, 03, 00, 00, 8B, F0, FF, 15, CC, E0, 40, 00, 50, E8, 6D, 03, 00, 00, 59, 89, 06, 5E, 5D, C3, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 69, 33, C0, 8A, 44, 24, 08, 84, C0, 75, 16, 81, FA, 80, 00, 00, 00, 72, 0E, 83, 3D, 58, 61, 41, 00, 00, 74, 05, E9, 50, 23, 00, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C...
 
[+]

Entropy:
6.3201

Code size:
49.5 KB (50,688 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Altonav Tray

Command:
"C:\Program Files\altonav\altonavtray.exe"


The file altonavTray.exe has been discovered within the following program.

Altonav  by Altonav
Altonav.com
About 9% of users remove it
 
Powered by Should I Remove It?

Remove altonavTray.exe - Powered by Reason Core Security