home

babylon10_setup.exe

Babylon Client Setup 1.0

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylon10_setup.exe, “Babylon Client Setup” by Babylon has been detected as adware by 13 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider.
Publisher:
Babylon Ltd.  (signed and verified)

Product:
Babylon Client Setup 1.0

Description:
Babylon Client Setup

Version:
1.0.8.0

MD5:
8b06bef7e43aeb14104595c2970b2950

SHA-1:
a6012a7a7c46b09c70f640a6b5ad2fd817947eee

SHA-256:
d8c046787b48d1f1dde00b1e0d723e459b72eb984991204ac905891862b255e6

Scanner detections:
13 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:
5/10/2024 8:41:07 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Babylon
7.1.1

AhnLab V3 Security
Adware/Win32.BHO
14.05.20

avast!
Win32:Adware-gen [Adw]
2014.9-140520

Baidu Antivirus
Adware.Win32.Bbylon
4.0.3.1487

Dr.Web
Adware.Downware.1733
9.0.1.0140

ESET NOD32
Win32/Toolbar.Babylon (variant)
8.9797

Fortinet FortiGate
Riskware/Toolbar_Babylon
5/20/2014

McAfee
Artemis!8B06BEF7E43A
5600.7124

NANO AntiVirus
Trojan.Win32.Downware.ctimdd
0.28.0.59826

Reason Heuristics
PUP.Installer.Babylon.P
14.8.7.19

Trend Micro House Call
TROJ_GEN.F47V0508
7.2.140

Trend Micro
ADW_BABYLON
10.465.20

VIPRE Antivirus
Babylon
29192

File size:
664.1 KB (680,056 bytes)

Copyright:
2011(c) Babylon Ltd. All rights reserved.

Original file name:
Setup_Stub.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\babylon10_setup.exe

Digital Signature
Signed by:
Babylon Ltd.

Authority:
Thawte, Inc.

Valid from:
2/12/2014 1:00:00 AM

Valid to:
3/8/2016 12:59:59 AM

Subject:
CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata
Compilation timestamp:
10/31/2013 4:22:53 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:1GxnqBmWUjEuWHPJu7NCoxjuna6VMN0/bMzGULQ5fdxfw:YxqgWUgSNCOaa6qC/QiU85f3fw

Entry address:
0x62D3

Entry point:
55, 8B, EC, 83, E4, F8, B8, 84, 1A, 00, 00, E8, 5D, F1, FF, FF, 53, 56, 33, DB, 57, 8D, 8C, 24, E8, 07, 00, 00, 88, 5C, 24, 13, C6, 44, 24, 14, 01, E8, 57, 06, 00, 00, 8D, 8C, 24, E8, 07, 00, 00, E8, CD, 05, 00, 00, 8D, 8C, 24, E8, 07, 00, 00, E8, 33, 05, 00, 00, 85, C0, 0F, 85, D9, 00, 00, 00, 8D, 44, 24, 18, 50, 8D, 8C, 24, EC, 07, 00, 00, E8, CB, 00, 00, 00, 8B, F0, 85, F6, 0F, 85, A0, 00, 00, 00, 66, 39, 5C, 24, 18, 74, 5E, 8B, 3D, 38, 91, 40, 00, 8D, 74, 24, 18, 6A, 03, 68, D8, D2, 40, 00, 56, FF, D7...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
30 KB (30,720 bytes)

The file babylon10_setup.exe has been seen being distributed by the following 25 URLs.

http://www.babylon.com/.../download.cgi?type=100&d=d63250ecc32b523070c06330ed91a07f

http://www.babylon.com/.../download.cgi?type=100&d=82ed56de9c241e94fc45de1c1b386e45

http://www.babylon.com/.../download.cgi?type=100&d=25f9488b4011cf072e255729939345a0

http://www.babylon.com/.../download.cgi?type=100&d=762f25a78ea6040ccfc81364412b850b

http://www.babylon.com/.../download.cgi?type=100&d=c1d845333c3743d8a92cfde8c074ae24&hclink=1

http://www.babylon.com/.../download.cgi?type=100&d=e189fb57b3b1eb42a6028d0c9df3e9d9

http://www.babylon.com/.../download.cgi?type=100&d=db291750c5395c73e352e68ef8837972

http://www.babylon.com/.../download.cgi?type=100&d=da81014701c998781c989e8f927023c1

http://www.babylon.com/.../download.cgi?type=100&d=7c3340f8fd4c57f7bb3c0f8c769dc5e3

http://www.babylon.com/.../download.cgi?type=100&d=60d9756d444329bee5c2f3c3d42654e1

http://www.babylon.com/.../download.cgi?type=100&d=0c6ab83b732d83ef3536f772a1510860

http://www.babylon.com/.../download.cgi?type=100&d=c2738506ae3f632d735e8aa0f55dc7b4

http://www.babylon.com/.../download.cgi?type=100&d=ede9d5151704aa38720fe05d93b722f8

http://www.babylon.com/.../download.cgi?type=100&d=88f2a5a8e9bcf547288f912176a5da4d

http://www.babylon.com/.../download.cgi?type=100&d=56a272e8bc84b533c2397bc20341682a

http://www.babylon.com/.../download.cgi?type=100&d=df6fd5ccf9fd735c8e3eb3f62052b569

http://www.babylon.com/.../download.cgi?type=100&d=fba418499336fda0d1586b8edba7b04e

http://www.babylon.com/.../download.cgi?type=100&d=11dc377b2907b458b34a71a726d7477c

http://www.babylon.com/.../download.cgi?type=100&d=20be640b9d97e29b788a490d7a9b1457

http://www.babylon.com/.../download.cgi?type=100&d=b56450bc0028fc22f77ceed9078ed499

http://www.babylon.com/.../download.cgi?type=100&d=7bb090c467ba718a570712a5d4aaa4cd

http://www.babylon.com/.../download.cgi?type=100&d=5da661eaafea6bc70db17b0bbc33c6f0

http://dl.babylon.com/site/files/.../Babylon10_setup.exe

http://www.babylon.com/.../download.cgi?type=100&d=de004d90dce6c83f826d3001691973e8

http://www.babylon.com/.../download.cgi?type=100&d=81caf82c6131d4f93d95d33e04062ee2

Remove babylon10_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.