home

dc535.exe

BrowserAir (GOOBZO LTD)

The application dc535.exe by BrowserAir (GOOBZO) has been detected as adware by 16 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler.
Publisher:
BrowserAir (GOOBZO LTD)  (signed and verified)

Version:
2.10.0.999

MD5:
c4d5d5a0c4fa909645564336f32151f3

SHA-1:
bde7786323ef8854920350a435379f4e12280671

SHA-256:
72a18f9c3e311d7a9ba8c73d4bb42f065cb4656fa53022a7bc649f13baa72707

Scanner detections:
16 / 68

Status:
Adware

Analysis date:
5/22/2024 2:15:26 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.688663
543

Agnitum Outpost
Trojan.DR.Agent
7.1.1

Avira AntiVirus
TR/Agent.2293656.1
8.3.1.6

Arcabit
Trojan.Kazy.DA8217
1.0.0.425

Bitdefender
Gen:Variant.Kazy.688663
1.0.20.1115

Bkav FE
HW32.Packed
1.3.0.7062

Emsisoft Anti-Malware
Gen:Variant.Kazy.688663
8.15.08.11.05

Fortinet FortiGate
W32/Agent.BJPBQC!tr
8/11/2015

F-Secure
Gen:Variant.Kazy.688663
11.2015-11-08_3

G Data
Gen:Variant.Kazy.688663
15.8.25

Kaspersky
Trojan-Dropper.Win32.Agent.bjpbqc
14.0.0.1599

Malwarebytes
PUP.Optional.BrowserAir.C
v2015.08.11.05

MicroWorld eScan
Gen:Variant.Kazy.688663
16.0.0.669

Panda Antivirus
Adware/Goobzo
15.08.11.05

Reason Heuristics
PUP.Goobzo (M)
15.8.11.5

VIPRE Antivirus
Trojan.Win32.Generic
42700

File size:
2.2 MB (2,293,656 bytes)

Product version:
2.10.0.999

Copyright:
Copyright (C) 2014

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\appdata\local\installer\install_24658\dc535.exe

Digital Signature
Signed by:
BrowserAir (GOOBZO LTD)

Authority:
COMODO CA Limited

Valid from:
2/10/2015 4:00:00 PM

Valid to:
2/11/2016 3:59:59 PM

Subject:
CN=BrowserAir (GOOBZO LTD), O=BrowserAir (GOOBZO LTD), STREET="Bldg #15 Matam", L=Haifa, S=Haifa, PostalCode=31905, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3B4F9A8B40F303C8AAD1D77B2A2B4674

File PE Metadata
Compilation timestamp:
8/2/2015 11:58:12 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:4JrZgGBXzMbIAoh4tvUlGYnR/LoRwgCffPHJ3HfytVAmQL97Ee4Xe5Nj:4J3BUIDhgMllLllnFfD4Xenj

Entry address:
0x2A5A98

Entry point:
0F, 80, 8B, 1D, 20, 00, 68, F1, 75, DA, 64, 52, E9, A4, CF, 1E, 00, 66, C7, 04, 24, 94, 18, 69, D2, 0A, 00, 00, 00, 52, E9, 51, 20, 20, 00, B1, B1, 31, BA, 6A, 3B, D6, 1F, 17, ED, C9, E4, 8D, 70, 14, 85, ED, FD, B5, 76, 34, A4, 50, 93, 28, C3, 3D, E2, 75, 57, A9, A2, 5E, 16, 06, 56, D6, 35, DA, C0, 6F, CD, 27, 8B, 1A, 53, 40, 1F, 82, 3E, C4, E8, E4, 57, D3, 38, B4, AF, 71, F9, 45, 8D, D5, FD, D3, 7B, 35, C5, 61, EA, 9A, 83, 12, 2A, BD, 70, D6, 69, 5E, 1D, 7E, 0E, D7, 87, A2, 54, 14, A7, 5A, AD, 31, 35, D6...
 
[+]

Entropy:
7.9092  (probably packed)

Code size:
548.5 KB (561,664 bytes)

Scheduled Task
Task name:
Inst_Rep

Trigger:
Registration (Runs on registration)


Remove dc535.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.