CrossriderApp0033708.exe

Database Clone stag Clone

Tran Minh Hao

This is the Crossrider web browser extension installer that contains the files for installing a plugin for IE, Chrome and Firefox. It was built by developer (#33708) Tran Minh Hao at http://crossrider.com/install/33708. The application CrossriderApp0033708.exe, “Database Clone stag Clone Installer” has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer, however the file is not signed with an authenticode signature from a trusted source. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.
Publisher:
Tran Minh Hao

Product:
Database Clone stag Clone

Description:
Database Clone stag Clone Installer

Version:
1.34.5.29

MD5:
bc758e439c5a375db2c065545ae2d09f

SHA-1:
af039425baebe7f9cf9b256c09a3d6092d930a23

SHA-256:
a718bf377414565de7cc90f6ca378ae5db4f22547c7ece84f4079c39ace031ad

Scanner detections:
5 / 68

Status:
Adware

Explanation:
Uses the Crossrider extension framework which may modify the browser's home, new tab and search pages as well as displays advertisements such as banner ads and text-links.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
8/11/2020 2:50:58 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
HW32.CDB
1.3.0.4959

ESET NOD32
Win32/Packed.ScrambleWrapper.I potentially unwanted application
7.0.302.0

McAfee
Adware-Crossrider
5600.7105

Reason Heuristics
PUP.Downloader.Installer.U
14.6.9.3

VIPRE Antivirus
Threat.4789396
30086

File size:
3.4 MB (3,579,729 bytes)

Copyright:
Copyright Tran Minh Hao

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\downloads\crossriderapp0033708.exe

File PE Metadata
Compilation timestamp:
12/4/2012 5:55:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
98304:rtmGuvhJ7pBHFAIVJxbBRUf0kTYcp0F8Vp:Ov9BHnVJxbBaflTMF8Vp

Entry address:
0x4323

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, C3, 44, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, C4, 44, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, C4, 44, 00, 56, A3, 40, 3B, 44, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 3B, 44, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, C4, 44, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.9893  (probably packed)

Code size:
34.5 KB (35,328 bytes)

The file CrossriderApp0033708.exe has been seen being distributed by the following URL.

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to stats.statsmyapp.com  (176.32.99.156:80)

TCP (HTTP):
Connects to staging-app.crossrider.com  (149.126.72.103:80)

 
http://staging-app.crossrider.com/plugin/apps/33708/manifest/1_34_5_29/ie9/manifest.xml?ver=15&rnd=6341

Remove CrossriderApp0033708.exe - Powered by Reason Core Security