Babylon.exe

Babylon Client

Babylon Software

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application Babylon.exe, “Babylon Information Tool” by Babylon Software has been detected as adware by 2 anti-malware scanners. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory. While running, it connects to the Internet address ba-sh-us-dc4-010.babsft.com on port 80 using the HTTP protocol.
Publisher:
Babylon Software Ltd.  (signed by Babylon Software)

Product:
Babylon Client

Description:
Babylon Information Tool

Version:
10.5.0.4

MD5:
19990fd81bca7597563944e756430100

SHA-1:
84e48dbb1aace8587f067aca0b53620637ce0e43

SHA-256:
dba9529ac8dfea2325e506b78827d2dba312413c7db3a8ce90ececce178974d6

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
4/19/2024 9:29:55 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Babylon.36
9.0.1.0193

Reason Heuristics
PUP.Babylon.BabylonSoftware (M)
15.7.12.23

File size:
2.4 MB (2,477,912 bytes)

Product version:
10.5.0.4

Copyright:
Copyright © Babylon Software Ltd. 1997-2015

Original file name:
Babylon.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\babylon.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
12/8/2014 1:00:00 AM

Valid to:
12/8/2016 12:59:59 AM

Subject:
CN=Babylon Software, O=Babylon Software, L=Or Yehuda, S=Tel Aviv, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7B8E754BED548B30647F4329D78D3F91

File PE Metadata
Compilation timestamp:
7/5/2015 1:04:08 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:jhVB9YZHC01fmI69C509LAWQXvyF/JW54n8d:jhVB9N01fU9wCDOyF/JW5x

Entry address:
0x10CEF2

Entry point:
E8, CC, FA, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 80, A3, 5C, 00, E8, E8, 47, 00, 00, E8, A7, 39, 00, 00, 0F, B7, F0, 6A, 02, E8, 5F, FA, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 33, 9D, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
1.3 MB (1,382,400 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ba-sh-us-dc4-010.babsft.com  (65.60.2.77:80)

TCP (HTTP):
Connects to sh3srv1.babylon.com  (198.143.128.242:80)

TCP (HTTP):
Connects to DedLoadLM2200.babylon.com  (184.154.27.230:80)

TCP (HTTP):
Connects to ba-sh-nl-dc1-007.babsft.com  (198.20.106.253:80)

TCP (HTTP):
Connects to ba-sh-nl-dc-006.babsft.com  (107.6.141.13:80)

TCP (HTTP):
Connects to singhop0014.babsft.com  (96.127.151.132:80)

TCP (HTTP):
Connects to singhop0013.babsft.com  (108.163.228.180:80)

TCP (HTTP):
Connects to ba-sh-us-dc1-020.babsft.com  (69.175.51.133:80)

TCP (HTTP):
Connects to server-54-230-187-19.cdg51.r.cloudfront.net  (54.230.187.19:80)

TCP (HTTP):
Connects to server-54-192-203-224.fra50.r.cloudfront.net  (54.192.203.224:80)

TCP (HTTP):
Connects to server-54-192-203-149.fra50.r.cloudfront.net  (54.192.203.149:80)

Remove Babylon.exe - Powered by Reason Core Security