» Client.exe
Overview
Analysis
File Details
Programs (2)
Network (99)

Client.exe

The application Client.exe has been detected as a potentially unwanted program by 13 anti-malware scanners. Additionally, the file is typically installed by a number of programs including Rockettab by Rich River Media, LLC and “RocketTab” by Adknowledge, both potentially unwanted software.

File name:

Client.exe

Version:

1.0.5658.21782

MD5:

336823473ae1cbcacc03f9934a3259ac

SHA-1:

500f2b24778b77651696987192963b5ce05501a9

SHA-256:

40bdddb6726d6fe3e475cffc3336424b6971a801d71d4722dd2482ca96d3558b

Scanner detections:

13 / 68

Status:

Potentially unwanted

Analysis date:

4/27/2024 11:45:27 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.RocketTab

2015.06.30

avast!

Win32:IBryte-EP [PUP]

2014.9-150630

Baidu Antivirus

Adware.MSIL.iBryte

4.0.3.15630

Emsisoft Anti-Malware

Application.Generic.1392916

11.5.0.6191

ESET NOD32

MSIL/Adware.iBryte.F application

6.3

F-Prot

W32/A-425915ce

v6.4.7.1.166

F-Secure

Riskware.Application.Generic.1392916

5.15.96

G Data

Win32.Adware.Rockettab

15.6.25

Kaspersky

not-a-virus:AdWare.MSIL.RocketTab

15.0.0.562

Malwarebytes

PUP.Optional.RocketTab.A

v2015.06.30.07

McAfee

Program.Adware-RocketTab

17.6.569.0

Norman

Application.Generic.1392916

19.05.2016 01:04:49

Reason Heuristics

PUP.iBryte (M)

16.7.14.0

File size:

1.4 MB (1,457,664 bytes)

Product version:

1.0.5658.21782

Original file name:

Client.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\search extensions\client.exe

File PE Metadata

Compilation timestamp:

6/29/2015 4:06:22 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:+vJW6tB49UKBMQ0p6nS+Sf61RxMYwPyRILzztpWAyVo:+ftBe1i6nSB6bfwPyeJpWAco

Entry address:

0x15B102

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.0999

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.3 MB (1,413,632 bytes)

The file Client.exe has been discovered within the following programs.

“RocketTab” by Adknowledge

RocketTab is a web browser extension that injects display advertising in the user's browser. Ads are displayed in the form of banners and contextual text-links and are both injected in white space areas of the HTML page or over existing ads of the underlying web site.

85% remove it

Rockettab by Rich River Media, LLC

RocketTab is an adware program that injects advertising in the user's web browser by creating a local proxy server and routing all Internet traffic through that proxy. By re-routing traffic the service will be able to include various ads in the HTML of the displaying web page.

rockettab.com

88% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ec2-54-221-254-214.compute-1.amazonaws.com (54.221.254.214:80)

TCP (HTTP):

Connects to ec2-54-243-115-164.compute-1.amazonaws.com (54.243.115.164:80)

TCP (HTTP):

Connects to ec2-54-235-186-78.compute-1.amazonaws.com (54.235.186.78:80)

TCP (HTTP SSL):

Connects to any-in-2014.1e100.net (216.239.32.20:443)

TCP (HTTP):

Connects to ec2-54-235-170-110.compute-1.amazonaws.com (54.235.170.110:80)

TCP (HTTP):

Connects to ec2-23-23-122-91.compute-1.amazonaws.com (23.23.122.91:80)

TCP (HTTP):

Connects to ec2-23-21-54-183.compute-1.amazonaws.com (23.21.54.183:80)

TCP (HTTP):

Connects to ec2-35-163-9-66.us-west-2.compute.amazonaws.com (35.163.9.66:80)

TCP (HTTP SSL):

Connects to xx-fbcdn-shv-01-cdg2.fbcdn.net (179.60.192.7:443)

TCP (HTTP):

Connects to server-54-230-78-54.cdg50.r.cloudfront.net (54.230.78.54:80)

TCP (HTTP):

Connects to server-54-192-119-21.sfo9.r.cloudfront.net (54.192.119.21:80)

TCP (HTTP SSL):

Connects to s3-1.amazonaws.com (54.231.81.244:443)

TCP (HTTP SSL):

Connects to rtr3.l7.search.vip.bf1.yahoo.com (63.250.200.63:443)

TCP (HTTP):

Connects to haproxy10.ca.servers.visadd.com (167.114.83.160:80)

TCP (HTTP SSL):

Connects to edge-star-mini-shv-01-sin6.facebook.com (157.240.7.35:443)

TCP (HTTP SSL):

Connects to edge-star-mini-shv-01-cdg2.facebook.com (179.60.192.36:443)

TCP (HTTP):

Connects to ec2-54-69-82-117.us-west-2.compute.amazonaws.com (54.69.82.117:80)

TCP (HTTP):

Connects to ec2-54-243-170-226.compute-1.amazonaws.com (54.243.170.226:80)

TCP (HTTP):

Connects to ec2-54-243-163-248.compute-1.amazonaws.com (54.243.163.248:80)

TCP (HTTP):

Connects to ec2-54-243-163-102.compute-1.amazonaws.com (54.243.163.102:80)

Remove Client.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.