ContentExplorer.exe

Application Genius, LLC

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application ContentExplorer.exe by Application Genius has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 49446 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
ContentExplorer  (signed by Application Genius, LLC)

Product:
ContentExplorer

Version:
8.0

MD5:
e5165a8c53035021ecfa084faeb9aef2

SHA-1:
de826a9d61dbfdd921bacc554c04dd66f6f9f44e

SHA-256:
506dfbcdd9eba4e1fff47af3037c03f7316874c682582a7a58a52c765491f8a7

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/27/2024 4:23:34 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.204.248

avast!
Win32:Adware-gen [Adw]
2014.9-150125

AVG
Generic
2016.0.3218

Baidu Antivirus
Adware.Win32.iBryte
4.0.3.15125

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
20835

Dr.Web
Trojan.iBryte.284
9.0.1.025

ESET NOD32
MSIL/Adware.iBryte (variant)
9.11068

Fortinet FortiGate
Adware/IBryte
1/25/2015

F-Secure
Adware.BrowseFox.BB
11.2015-14-02_7

McAfee
Artemis!B211B824C314
5600.6874

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Adknowledge
15.2.14.11

Sophos
Generic PUA NO
4.98

Trend Micro House Call
Suspicious_GEN.F47V0104
7.2.25

VIPRE Antivirus
iBryte
36956

File size:
2.3 MB (2,392,760 bytes)

Product version:
8.0

Copyright:
Copyright © ContentExplorer 2014

Original file name:
ContentExplorer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\contentexplorer\contentexplorer.exe

Digital Signature
Authority:
GoDaddy.com, Inc.

Valid from:
12/30/2014 6:32:38 PM

Valid to:
12/29/2016 3:07:38 PM

Subject:
CN="Application Genius, LLC", O="Application Genius, LLC", L=Walnut, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
629B575CD8F3186B

File PE Metadata
Compilation timestamp:
1/3/2015 5:00:29 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:A8WkMSRdQNBQdGAVOWxV640q2rLaKDJXe9WDU0PJ:vjvRdQ7RAVrxV6405SKFXGWDU8J

Entry address:
0x24715A

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8372

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.3 MB (2,380,288 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:49446/

Local host port:
49446

Default credentials:
No


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-39-108.jfk1.r.cloudfront.net  (54.230.39.108:80)

TCP (HTTP):
Connects to server-54-230-38-201.jfk1.r.cloudfront.net  (54.230.38.201:80)

TCP (HTTP):
Connects to server-54-192-39-184.jfk1.r.cloudfront.net  (54.192.39.184:80)

TCP (HTTP):
Connects to s3-1-w.amazonaws.com  (54.231.1.225:80)

TCP (HTTP SSL):
Connects to float.698.bm-impbus.prod.nym2.adnexus.net  (68.67.152.219:443)

TCP (HTTP):
Connects to ec2-54-245-231-172.us-west-2.compute.amazonaws.com  (54.245.231.172:80)

TCP (HTTP):
Connects to ec2-54-225-209-99.compute-1.amazonaws.com  (54.225.209.99:80)

TCP (HTTP):
Connects to ec2-54-213-183-186.us-west-2.compute.amazonaws.com  (54.213.183.186:80)

TCP (HTTP):
Connects to ec2-54-208-233-108.compute-1.amazonaws.com  (54.208.233.108:80)

TCP (HTTP):
Connects to ec2-54-174-236-113.compute-1.amazonaws.com  (54.174.236.113:80)

TCP (HTTP):
Connects to ec2-50-19-83-149.compute-1.amazonaws.com  (50.19.83.149:80)

TCP (HTTP):
Connects to ec2-23-21-92-35.compute-1.amazonaws.com  (23.21.92.35:80)

TCP (HTTP):
Connects to dl18.clickmein.com  (50.7.74.170:80)

TCP (HTTP):
Connects to compute-199-19-212-190.ymq-zone1.thenebulacloud.com  (199.19.212.190:80)

TCP (HTTP SSL):
Connects to cloud.gti.mcafee.com  (161.69.92.6:443)

TCP (HTTP):

TCP (HTTP SSL):
Connects to a23-218-140-65.deploy.static.akamaitechnologies.com  (23.218.140.65:443)

TCP (HTTP SSL):
Connects to a23-218-136-236.deploy.static.akamaitechnologies.com  (23.218.136.236:443)

TCP (HTTP):
Connects to a23-192-160-16.deploy.static.akamaitechnologies.com  (23.192.160.16:80)

TCP (HTTP):
Connects to a184-51-126-107.deploy.static.akamaitechnologies.com  (184.51.126.107:80)

Remove ContentExplorer.exe - Powered by Reason Core Security