home

claraupdater.exe

ClaraUpdater

CLARALABSOFTWARE

The application claraupdater.exe by CLARALABSOFTWARE has been detected as a potentially unwanted program by 4 anti-malware scanners. Additionally, the file is typically installed by a number of programs including I - Cinema by Bright circle investments Ltd. and BoBrowser by BoBrowser, both potentially unwanted software. The file has been seen being downloaded from vzbucket.clara-labs.com.
Publisher:
ClaraLabs  (signed by CLARALABSOFTWARE)

Product:
ClaraUpdater

Version:
3.16.4.3

MD5:
c5d597dea24509ffa0c69e0dba391b01

SHA-1:
9df9447442007b9a6334a1a6f47116ae25e67b1d

SHA-256:
8b0c59995140c347f69fad6484ffdf8428a1e7ce0dd6c57110938f89ea23cceb

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 6:28:44 PM UTC  (today)

Scan engine
Detection
Engine version

G Data
Win32.Adware.Clara
15.4.25

Panda Antivirus
PUP/Clara
15.04.17.09

Reason Heuristics
PUP.CLARALABSOFTWARE
15.4.17.5

Rising Antivirus
PE:PUF.Clicker.Pimpo!1.9C67
23.00.65.15415

File size:
866.6 KB (887,408 bytes)

Product version:
3.16.4.3

Copyright:
Copyright (C) 2014

Original file name:
Updater.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\common files\claraupdater\claraupdater.exe

Digital Signature
Signed by:
CLARALABSOFTWARE

Authority:
GlobalSign nv-sa

Valid from:
7/29/2014 9:13:08 AM

Valid to:
7/30/2015 9:13:08 AM

Subject:
CN=CLARALABSOFTWARE, O=CLARALABSOFTWARE, L=Paris, C=FR

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E6E5C72C946A5248674AB7B56E24B246

File PE Metadata
Compilation timestamp:
4/16/2015 2:00:48 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:TlKsYJSWBYJ+68XaumFRFabfP+Q/o/Hbk+M2:TlbYJWVQr+Fbk+M2

Entry address:
0x7D095

Entry point:
E8, A8, 06, 01, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, 83, EC, 18, 8D, 4D, E8, 53, 57, FF, 75, 0C, E8, 20, C5, FF, FF, 8B, 5D, 08, BF, 00, 01, 00, 00, 3B, DF, 73, 60, 8B, 4D, E8, 83, 79, 74, 01, 7E, 14, 8D, 45, E8, 50, 6A, 01, 53, E8, 98, 07, 01, 00, 8B, 4D, E8, 83, C4, 0C, EB, 0D, 8B, 81, 90, 00, 00, 00, 0F, B7, 04, 58, 83, E0, 01, 85, C0, 74, 1E, 80, 7D, F4, 00, 8B, 81, 94, 00, 00, 00, 0F, B6, 0C, 18, 74, 07, 8B, 45, F0, 83, 60, 70, FD, 8B, C1, E9, D2, 00, 00, 00, 80, 7D, F4, 00, 74, 07, 8B, 4D, F0, 83, 61...
 
[+]

Entropy:
6.7473

Code size:
640 KB (655,360 bytes)

The file claraupdater.exe has been discovered within the following programs.

BoBrowser  by BoBrowser
38% remove it
I - Cinema  by Bright circle investments Ltd.
i - cinema is a web browser extension that injects display advertising in the user's browser. Ads are displayed in the form of banners and contextual text-links and are both injected in white space areas of the HTML page or over existing ads of the underlying web site.
88% remove it
 
Powered by Should I Remove It?

The file claraupdater.exe has been seen being distributed by the following URL.

http://vzbucket.clara-labs.com/267f64d7-5811-419d-b4ff-d5c9afe1a8dd/build/.../c2646b6d-4adc-4d7e-96e9-4d4fce8f2602.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-50-19-113-170.compute-1.amazonaws.com  (50.19.113.170:80)

TCP (HTTP):
Connects to ec2-23-23-112-220.compute-1.amazonaws.com  (23.23.112.220:80)

Remove claraupdater.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.