bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5.exe

P-HD-V1.4

Motoko Group

This adware utilizes the Crossrider extension platform and will inject advertisiments in the Internet browser and may modify core browser settings. Ads will be delivered as banners and contextual text-links and may promote other potentially unwanted software. The application bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5.exe by Motoko Group has been detected as adware by 22 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This will display various ads in the web browser such as popups, interstitial and in-text links and distributed through various monetization platforms. It will also modify browser settings such as the search and home page. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
P-HD  (signed by Motoko Group)

Product:
P-HD-V1.4

Description:
P-HD-V1.4 exe

Version:
1000.1000.1000.1000

MD5:
1a4076da6e48b9b8cb246853dda5ede0

SHA-1:
3e137bb62b715d202aca2d54b5119493c954fd1e

SHA-256:
a04f0868e14dc1287b404e372e15f0b42e8138c2d5e1c1bf07939679cbbe2a99

Scanner detections:
22 / 68

Status:
Adware

Explanation:
May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage). Distributed through the Brightcircle investments brand.

Analysis date:
4/19/2024 6:31:20 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.374109
918

AhnLab V3 Security
PUP/Win32.CrossRider
2014.07.31

Avira AntiVirus
ADWARE/CrossRider.Gen2
7.11.164.150

avast!
Win32:Adware-gen [Adw]
2014.9-140731

AVG
Generic
2015.0.3396

Bitdefender
Gen:Variant.Adware.Kazy.374109
1.0.20.1060

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.374109
8.14.07.31.01

ESET NOD32
Win32/Toolbar.CrossRider.AH (variant)
8.10178

Fortinet FortiGate
W32/GoogUpdate.AH!tr
7/31/2014

F-Secure
Gen:Variant.Adware.Kazy.374109
11.2014-31-07_5

G Data
Gen:Variant.Adware.Kazy.374109
14.7.24

IKARUS anti.virus
not-a-virus:WebToolbar.CrossRider
t3scan.1.6.1.0

Kaspersky
Trojan.NSIS.GoogUpdate
14.0.0.3477

Malwarebytes
PUP.Optional.PlusHD.A
v2014.07.31.01

McAfee
Artemis!1A4076DA6E48
5600.7052

MicroWorld eScan
Gen:Variant.Adware.Kazy.374109
15.0.0.636

Panda Antivirus
Trj/Genetic.gen
14.07.31.01

Reason Heuristics
PUP.MotokoGroup.g
14.7.31.13

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.14729

Sophos
Generic PUA DO
4.98

VIPRE Antivirus
Threat.4789396
31208

File size:
470.9 KB (482,152 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
P-HD-V1.4.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\p-hd-v1.4\bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
7/18/2014 4:00:00 AM

Valid to:
7/19/2015 3:59:59 AM

Subject:
CN=Motoko Group, O=Motoko Group, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AAFC4F8011F7FD7C00748C990950D28A

File PE Metadata
Compilation timestamp:
7/28/2014 3:08:50 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:prdDoo+82gE/MM9P2KVHBy3KHfRc/7jWxvugzt1upTBUkeJdOLakIS:pZv2gE/MMc2HBy3K5cH6BzvupTOZdpS

Entry address:
0x3CFC6

Entry point:
E8, 0F, CB, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, F8, 14, 47, 00, E8, 04, 4A, 00, 00, E8, 78, 1D, 00, 00, 0F, B7, F0, 6A, 02, E8, A2, CA, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C0, 87, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.4861

Code size:
372 KB (380,928 bytes)

Scheduled Task
Task name:
bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5

Trigger:
Logon (Runs on logon)

Action:
bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5.exe \qbutmyhs \iuxorwrzw='p-hd-v1.4' \qyfallvcr=61764


Remove bb57d35d-458c-4fbd-aa09-d9bd7e8c8da9-5.exe - Powered by Reason Core Security