babylonportable.exe

Babylon Client

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application babylonportable.exe, “Babylon Information Tool” has been detected as adware by 2 anti-malware scanners. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from p-def4.pcloud.com.
Publisher:
Babylon Ltd.

Product:
Babylon Client

Description:
Babylon Information Tool

Version:
9.0.3.12

MD5:
a08b0a078bc7f44aa2f441fbfb4ecd8c

SHA-1:
c20ab7b577822e617d793ed0f7c18d2bab663ef5

SHA-256:
5d76b4edc0ce6b988677886f9a39c1c85efa8b91554ae67940c7e531ef6e3c70

Scanner detections:
2 / 68

Status:
Adware

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:
4/29/2024 7:09:34 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Toolbar.Escort (variant)
9.10045

Reason Heuristics
PUP.Babylon
15.3.2.7

File size:
38.4 MB (40,308,759 bytes)

Product version:
9.0.3.12

Copyright:
Copyright © Babylon Ltd. 1997-2011

Original file name:
babylon.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\babylonportable.exe

File PE Metadata
Compilation timestamp:
7/14/2011 9:59:51 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
393216:inz/VUpPKmuUp/KmDnUpOKmh3kqsCXOYV58fDPVrI3GJX:WbCpfJ3VcdBt

Entry address:
0x149B

Entry point:
9C, 60, 68, 53, 74, 41, 6C, 68, 54, 68, 49, 6E, E8, 00, 00, 00, 00, 58, BB, AC, 14, 00, 00, 2B, C3, 50, 68, 00, 00, BF, 79, 68, 00, 34, 00, 00, 68, 1C, 01, 00, 00, E8, 3E, FC, FF, FF, E9, B6, FC, FF, FF, 55, 8B, EC, 83, EC, 10, 53, 56, 57, 8B, 7D, 08, 8B, 47, 3C, 8D, 5C, 38, 78, 8B, 03, 85, C0, 0F, 84, 92, 00, 00, 00, 83, 7B, 04, 28, 0F, 82, 88, 00, 00, 00, 8D, 34, 38, 8B, 4E, 18, 85, C9, 74, 7E, 8B, 56, 20, 3B, D0, 72, 77, 8D, 14, 8A, 8B, 4B, 04, 03, C8, 3B, CA, 72, 6B, 8B, 46, 20, 83, 65, 08, 00, 03, C7...
 
[+]

Entropy:
6.5329

Code size:
12 KB (12,288 bytes)

The file babylonportable.exe has been seen being distributed by the following URL.

Remove babylonportable.exe - Powered by Reason Core Security