home

TheAnswerFinderInstall.exe

Installer

Mime Ventures LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file TheAnswerFinderInstall.exe by Mime Ventures has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. It is also typically executed from the user's temporary directory. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Mime Ventures LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
8b272a417c1d57d5d54cef8913144fbb

SHA-1:
6e903fdd9328fe987e33e4916688f8b8445bad7d

SHA-256:
35885882839a2fb83da870f17814e4882f7757e4d1921f150f82fee73e302920

Scanner detections:
7 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 5:11:51 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
Adware/iBryte.plsaza
7.11.214.34

AVG
Generic
2016.0.3179

Comodo Security
Application.MSIL.iBryte.JA
21309

ESET NOD32
MSIL/Adware.iBryte.R application
7.0.302.0

Malwarebytes
PUP.Optional.TheAnswerFinder.A
v2015.03.05.11

Norman
IBryte.AJQ
11.20150305

Reason Heuristics
PUP.Bundler.Softpulse
15.3.5.23

File size:
923.7 KB (945,880 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2014

Original file name:
TheAnswerFinderInstall.exe

Bundler/Installer:
Softpulse SoftwareBundler

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\awh8cd9.tmp

Digital Signature
Signed by:
Mime Ventures LLC

Authority:
GlobalSign nv-sa

Valid from:
10/17/2014 10:39:32 AM

Valid to:
10/18/2015 10:39:32 AM

Subject:
E=admin@theanswerfinder.com, CN=Mime Ventures LLC, OU=TheAnswerFinder.com, O=Mime Ventures LLC, L=Los Angeles, S=California, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EDDEAF81A380FF278B94B619A213DEEE

File PE Metadata
Compilation timestamp:
3/4/2015 8:01:30 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:ox9lJmaSgP1qFP/Z7Pbqg6XPGTibvUz78MrRm/Pq:ox9pSgtu/RDqnGTiAzVRcy

Entry address:
0xE4442

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.9480

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
905.5 KB (927,232 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove TheAnswerFinderInstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.