» Client.exe
Overview
Analysis
File Details
Programs (2)
Network (66)

Client.exe

The application Client.exe has been detected as a potentially unwanted program by 10 anti-malware scanners. Additionally, the file is typically installed by a number of programs including Rockettab by Rich River Media, LLC and RocketTab: by Adknowledge, Inc., both potentially unwanted software. While running, it connects to the Internet address static.vnpt.vn on port 443.

File name:

Client.exe

Version:

1.0.5654.17090

MD5:

c9d8b24ea1c897bb2ee5d38d537bf8ca

SHA-1:

bb159b0d43a061909a4a78c35b5ce512ff008b3f

SHA-256:

32891485c2d519b167197f0a1876696b1685aec1aa74a7f1425963f7d1ff6ede

Scanner detections:

10 / 68

Status:

Potentially unwanted

Analysis date:

4/23/2024 6:48:19 AM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.RocketTab

2015.06.27

avast!

Win32:IBryte-EP [PUP]

2014.9-150626

Baidu Antivirus

Adware.MSIL.iBryte

4.0.3.15626

ESET NOD32

MSIL/Adware.iBryte.F application

7.0.302.0

F-Prot

W32/A-425915ce

v6.4.7.1.166

G Data

Win32.Adware.Rockettab

15.6.25

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Generic

14.0.0.1827

Malwarebytes

PUP.Optional.RocketTab.A

v2015.06.26.02

McAfee

Program.Adware-RocketTab

17.6.569.0

Qihoo 360 Security

HEUR/QVM03.0.Malware.Gen

1.0.0.1015

File size:

1.4 MB (1,457,664 bytes)

Product version:

1.0.5654.17090

Original file name:

Client.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\search extensions\client.exe

File PE Metadata

Compilation timestamp:

6/25/2015 4:29:59 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:Ex7Y+OK/sD1Ke0Q0N6nSkSWxZ0no81SAOi4Plyaoavc7V1Ntz6:E6+OyUh86nSaxuo+Wi4NyaoavCnN

Entry address:

0x15B10A

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.1002

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.3 MB (1,413,632 bytes)

The file Client.exe has been discovered within the following programs.

Rockettab by Rich River Media, LLC

RocketTab is an adware program that injects advertising in the user's web browser by creating a local proxy server and routing all Internet traffic through that proxy. By re-routing traffic the service will be able to include various ads in the HTML of the displaying web page.

rockettab.com

88% remove it

RocketTab: by Adknowledge, Inc.

RocketTab is an advertising supported browser extension also known as adware and is designed to deliver ads to the user's Internet browser as banners, context text-links and transitionals ads. The injected ads are not affiliated with the underlying website on which they appear.

www.adknowledge.com

87% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ec2-54-235-170-110.compute-1.amazonaws.com (54.235.170.110:80)

TCP (HTTP):

Connects to ec2-54-221-254-214.compute-1.amazonaws.com (54.221.254.214:80)

TCP (HTTP SSL):

Connects to ec2-52-72-157-241.compute-1.amazonaws.com (52.72.157.241:443)

TCP (HTTP):

Connects to ec2-54-235-186-78.compute-1.amazonaws.com (54.235.186.78:80)

TCP (HTTP):

Connects to coccoc.com (123.30.175.50:80)

TCP (HTTP SSL):

Connects to static.vnpt.vn (113.171.241.237:443)

TCP (HTTP SSL):

Connects to ec2-34-192-150-200.compute-1.amazonaws.com (34.192.150.200:443)

TCP (HTTP):

Connects to ec2-50-17-224-168.compute-1.amazonaws.com (50.17.224.168:80)

TCP (HTTP SSL):

Connects to any-in-2014.1e100.net (216.239.32.20:443)

TCP (HTTP SSL):

Connects to xx-fbcdn-shv-01-hkg3.fbcdn.net (31.13.95.12:443)

TCP (HTTP SSL):

Connects to server-54-230-141-40.sfo5.r.cloudfront.net (54.230.141.40:443)

TCP (HTTP SSL):

Connects to server-54-230-141-129.sfo5.r.cloudfront.net (54.230.141.129:443)

TCP (HTTP):

Connects to server-54-192-139-29.lax1.r.cloudfront.net (54.192.139.29:80)

TCP (HTTP SSL):

Connects to server-54-192-120-74.dfw50.r.cloudfront.net (54.192.120.74:443)

TCP (HTTP):

Connects to server-52-85-83-9.lax1.r.cloudfront.net (52.85.83.9:80)

TCP (HTTP):

Connects to server-52-84-239-231.sfo5.r.cloudfront.net (52.84.239.231:80)

TCP (HTTP SSL):

Connects to server-52-84-144-182.yto50.r.cloudfront.net (52.84.144.182:443)

TCP (HTTP):

Connects to server-52-84-141-114.yto50.r.cloudfront.net (52.84.141.114:80)

TCP (HTTP):

Connects to s3-1-w.amazonaws.com (54.231.50.2:80)

TCP (HTTP):

Connects to s3-1.amazonaws.com (54.231.81.59:80)

Remove Client.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.