» f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (1)

f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe

Sense

Object Browser

The application f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe has been detected as adware by 26 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Sense by Object Browser which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

Publisher:

Object Browser

Product:

Sense

Description:

Sense exe

Version:

1000.1000.1000.1000

MD5:

bf4949f9c4ea44fb13c189c6b21ff5c1

SHA-1:

2a0cd1c79dd0892c543052e451c9fb9f1a39718f

SHA-256:

b7c6980de7dc94f4f8a8925b75e5dec21a85aeabd20269392b4cdfd60e4c48e7

Scanner detections:

26 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

4/24/2024 2:59:17 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Adware.Plush.1

799

AhnLab V3 Security

PUP/Win32.CrossRider

2014.09.20

Avira AntiVirus

Adware/CrossRider.A.9916

7.11.155.70

Baidu Antivirus

Adware.Win32.CrossRider

4.0.3.14919

Bitdefender

Gen:Adware.Plush.1

1.0.20.1660

Clam AntiVirus

Win.Adware.Agent-7235

0.98/19392

Dr.Web

Trojan.Crossrider.28009

9.0.1.05190

Emsisoft Anti-Malware

Gen:Adware.Plush

8.14.11.28.11

ESET NOD32

Win32/Toolbar.CrossRider.AC potentially unwanted application

8.7.0.302.0

F-Prot

W32/A-eb9ef301

v6.4.7.1.166

F-Secure

Gen:Adware.Plush.1

11.2014-28-11_6

G Data

Gen:Adware.Plush

14.9.24

herdProtect (fuzzy)

variant of e6d71045-dfc5-4fe9-8c7c-5d6560cd197d-2.exe (Adware)

2014.11.28.16

Kaspersky

not-a-virus:WebToolbar.Win32.CrossRider

15.0.0.494

Malwarebytes

PUP.Optional.SmartSaver.A

v2014.09.19.12

McAfee

Artemis!41918AD4F409

5600.7002

MicroWorld eScan

Gen:Adware.Plush.1

15.0.0.996

NANO AntiVirus

Riskware.Win32.AdLoad.dbemrh

0.28.0.60253

Panda Antivirus

PUP/PlusHD

14.09.19.12

Reason Heuristics

PUP.Crossrider.Task.g

14.9.19.12

Rising Antivirus

PE:Malware.Obscure!1.9C59

23.00.65.14917

Sophos

AppRider

4.98

Trend Micro House Call

TROJ_GEN.R002C0OI614

7.2.262

Trend Micro

TROJ_GEN.R002C0OI614

10.465.19

Vba32 AntiVirus

AdWare.AdLoad

3.12.26.3

VIPRE Antivirus

Threat.4789396

29708

File size:

361.5 KB (370,176 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Sense.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\sense\f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe

File PE Metadata

Compilation timestamp:

6/15/2014 11:03:57 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:9Egapw2k2x5PauCI63zamSfg6vpTBrbQ8:9Egap5nPau56jamSf3vpTV

Entry address:

0x2E1F1

Entry point:

E8, B1, 8F, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, C0, 6A, 45, 00, E8, 09, 25, 00, 00, E8, 89, 16, 00, 00, 0F, B7, F0, 6A, 02, E8, 44, 8F, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, B7, 62, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Code size:

275.5 KB (282,112 bytes)

Scheduled Task

Task name:

f1a726d4-098d-4503-ac48-1ea5d300b528-2

Trigger:

Logon (Runs on logon)

The file f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe has been discovered within the following program.

Sense by Object Browser

Sense is a potentially unwanted web browser extension that will attempt to modify the user's home and search page settings as well as display advertisements in the browser. The software will attach to IE, Chrome and Firefox.

85% remove it

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to ip-184-168-221-53.ip.secureserver.net (184.168.221.53:80)

Remove f1a726d4-098d-4503-ac48-1ea5d300b528-2.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.