babylon_pagerage.exe

SoGe Interactive LLC

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylon_pagerage.exe by SoGe Interactive has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory.
Publisher:
SoGe Interactive LLC  (signed and verified)

MD5:
acc66ba9b4f314d3131f37670a8e4a49

SHA-1:
67b996a129b07ba248ea0a1d2a37212ae0c0ce00

SHA-256:
feaeec54e4a674e67638477b4439c2f6b20f17c5550371c4b159e8dd63b91b0b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/23/2024 10:08:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Babylon (M)
16.10.20.1

File size:
1.3 MB (1,378,640 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\babylon_pagerage.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
12/3/2010 7:00:00 PM

Valid to:
12/3/2012 6:59:59 PM

Subject:
CN=SoGe Interactive LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SoGe Interactive LLC, L=Las Vegas, S=Nevada, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
37A37FA84B2105ECF3AE65698875268D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OsVc879oOc4MBs2vTLPqsdYVQ9XdPkAKG2vdgaon8WVYkAH:8879oOcrPvTbLXdD2908WVeH

Entry address:
0x14208

Entry point:
55, 8B, EC, B9, 0C, 00, 00, 00, 6A, 00, 6A, 00, 49, 75, F9, 51, 53, 56, 57, B8, 48, 41, 41, 00, E8, 1B, 15, FF, FF, 33, C0, 55, 68, AE, 47, 41, 00, 64, FF, 30, 64, 89, 20, 8D, 45, EC, E8, 9D, FE, FF, FF, 8B, 55, EC, B8, C0, 68, 45, 00, E8, C0, F8, FE, FF, B8, D0, 69, 45, 00, BA, C8, 47, 41, 00, E8, B1, F8, FE, FF, B8, D4, 69, 45, 00, BA, E8, 47, 41, 00, E8, A2, F8, FE, FF, 6A, 1D, 8D, 45, E8, 50, 8D, 45, E4, BA, B4, 53, 41, 00, B9, 18, 00, 00, 00, E8, A6, FA, FE, FF, 8B, 45, E4, B9, 52, 00, 00, 00, BA, 23...
 
[+]

Entropy:
7.9499

Developed / compiled with:
Microsoft Visual C++

Code size:
78.5 KB (80,384 bytes)

Remove babylon_pagerage.exe - Powered by Reason Core Security