home

dcbrakieamo_amobl_setup.exe

BrowserAir (GOOBZO LTD)

The application dcbrakieamo_amobl_setup.exe by BrowserAir (GOOBZO) has been detected as adware by 10 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. While running, it connects to the Internet address server-205-251-251-221.jfk5.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
BrowserAir (GOOBZO LTD)  (signed and verified)

Version:
2.9.0.999

MD5:
cd55edfb9885fee4b504d4663cd60ac9

SHA-1:
27eb7101f137450f13118f0b5e057317ad103480

SHA-256:
4aa4879b24272e4a2350fbe507185ecf927ccf40a67f223e6ffa34f27e3624e4

Scanner detections:
10 / 68

Status:
Adware

Analysis date:
4/26/2024 8:22:50 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Mikey.20257
561

Arcabit
Trojan.Mikey.D4F21
1.0.0.425

Bitdefender
Gen:Variant.Mikey.20257
1.0.20.1020

Bkav FE
HW32.Packed
1.3.0.6979

Emsisoft Anti-Malware
Gen:Variant.Mikey.20257
8.15.07.23.11

F-Secure
Gen:Variant.Mikey.20257
11.2015-23-07_5

G Data
Gen:Variant.Mikey.20257
15.7.25

MicroWorld eScan
Gen:Variant.Mikey.20257
16.0.0.612

Panda Antivirus
Adware/Goobzo
15.07.23.11

Reason Heuristics
PUP.Goobzo.Installer (M)
15.7.23.23

File size:
2.3 MB (2,383,256 bytes)

Product version:
2.9.0.999

Copyright:
Copyright (C) 2014

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\appdata\local\installer\installbrowserair_18975\dcbrakieamo_amobl_setup.exe

Digital Signature
Signed by:
BrowserAir (GOOBZO LTD)

Authority:
COMODO CA Limited

Valid from:
2/10/2015 4:00:00 PM

Valid to:
2/11/2016 3:59:59 PM

Subject:
CN=BrowserAir (GOOBZO LTD), O=BrowserAir (GOOBZO LTD), STREET="Bldg #15 Matam", L=Haifa, S=Haifa, PostalCode=31905, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3B4F9A8B40F303C8AAD1D77B2A2B4674

File PE Metadata
Compilation timestamp:
7/22/2015 11:55:37 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:whzTSs1LIbhSZouqKrO3Wixxpzcac4yOSKdCUaAcmiPzgFp9SwMMU4dlbpa:6Z9q4ihcac4kJULiPzssdMBE

Entry address:
0x4EC63B

Entry point:
60, C7, 44, 24, 1C, 22, 03, 73, 00, 60, 51, C7, 44, 24, 3C, B2, C5, 0A, F3, 88, 64, 24, 04, 8D, 64, 24, 3C, E9, CE, 29, 00, 00, D2, E3, 00, 5A, 04, 76, A2, 28, C4, F1, 33, 8D, 77, AD, DD, E4, 3E, 5C, FC, 29, 3B, 91, 73, C5, AF, 09, 3B, 69, 01, C0, 92, 18, 80, 2D, DD, 53, 2A, C7, 03, 28, A2, 7F, 39, C6, 44, BB, 57, 82, 6C, B6, 42, D4, 53, 26, C7, 7C, 19, 80, 69, BC, A1, 05, 16, A9, BE, E8, 04, 6D, 77, C5, B2, E0, 06, 8F, 1B, 4D, AA, E8, FC, 00, 89, 13, 8F, 2E, D1, 32, 69, D1, DF, FC, 7C, 36, 78, 66, B9, E9...
 
[+]

Entropy:
7.9050  (probably packed)

Code size:
548.5 KB (561,664 bytes)

Scheduled Task
Task name:
Installer_browserAir

Trigger:
Logon (Runs on logon)


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-50-176.jfk5.r.cloudfront.net  (54.230.50.176:80)

TCP (HTTP):
Connects to server-205-251-251-221.jfk5.r.cloudfront.net  (205.251.251.221:80)

Remove dcbrakieamo_amobl_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.