home

f38ebc9ed8f43a5d5f09b98ce61f9c32.exe

Jump Flip

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application f38ebc9ed8f43a5d5f09b98ce61f9c32.exe, “TODO: <File description>” by Jump Flip has been detected as adware by 38 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages. While running, it connects to the Internet address install.jumpflip.net on port 80 using the HTTP protocol.
Publisher:
TODO: <Company name>  (signed by Jump Flip)

Description:
TODO: <File description>

Version:
4.0.0.3

MD5:
f38ebc9ed8f43a5d5f09b98ce61f9c32

SHA-1:
8882b2dcd3738357b29b87adf64cca02e31ff7f3

SHA-256:
8a87a35fe580397b0bcb88df42a53688d4f91e3b5fa6edebfeca2a22b0692946

Scanner detections:
38 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/27/2024 4:18:57 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.BU
536

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.BrowseFox
2015.07.14

Avira AntiVirus
ADWARE/BrowseFox.Gen
8.3.1.6

Arcabit
Adware.BrowseFox.BU
1.0.0.425

avast!
Win32:BrowseFox-DZ [PUP]
2014.9-150818

AVG
Adware AdPlugin
2016.0.3014

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.15818

Bitdefender
Adware.BrowseFox.BU
1.0.20.1150

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Browsefox-205
0.98/20522

Comodo Security
TrojWare.Win32.BrowseFox.FY
22754

Dr.Web
Trojan.Yontoo.1808
9.0.1.0230

Emsisoft Anti-Malware
Adware.BrowseFox.BU
8.15.08.18.03

ESET NOD32
Win32/BrowseFox.M potentially unwanted application
9.7.0.302.0

Fortinet FortiGate
Riskware/BrowseFox
8/18/2015

F-Prot
W32/S-c20eddc6
v6.4.7.1.166

F-Secure
Adware.BrowseFox.BU
11.2015-18-08_3

G Data
Adware.BrowseFox.BU
15.8.25

herdProtect (fuzzy)
variant of 45d394d22d684d5fb184c36205b16b25.dll (Adware)
2015.10.3.15

K7 AntiVirus
Trojan
13.205.16545

Kaspersky
not-a-virus:AdWare.Win32.Yotoon
14.0.0.1564

Malwarebytes
PUP.Optional.JumpFlip.A
v2015.08.18.03

McAfee
Program.BrowseFox-FWL
5600.6670

MicroWorld eScan
Adware.BrowseFox.BU
16.0.0.690

NANO AntiVirus
Trojan.Win32.BPlug.dmjqza
0.30.24.2487

Norman
Adware.BrowseFox.BU
11.20151003

nProtect
Adware.BrowseFox.BU
15.07.13.01

Panda Antivirus
Generic Suspicious
15.08.18.03

Qihoo 360 Security
HEUR/QVM30.1.Malware.Gen
1.0.0.1015

Quick Heal
PUA.Jumpflip.Gen
8.15.14.00

Reason Heuristics
PUP.Yontoo.JumpFlip (M)
15.8.18.3

Rising Antivirus
PE:Adware.SwiftBrowse!6.1BA9
23.00.65.15816

SUPERAntiSpyware
Adware.BrowseFox/Variant
9685

Trend Micro
TROJ_GEN.R0C1C0EFS15
10.465.18

Vba32 AntiVirus
AdWare.Kranet
3.12.26.4

VIPRE Antivirus
Threat.4150696
40552

Zillya! Antivirus
Adware.Agent.Win32.37670
2.0.0.2286

File size:
278.8 KB (285,472 bytes)

Product version:
4.0.0.3

Copyright:
TODO: (c) <Company name>. All rights reserved.

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Jump Flip

Authority:
VeriSign, Inc.

Valid from:
8/22/2013 8:00:00 AM

Valid to:
8/23/2015 7:59:59 AM

Subject:
CN=Jump Flip, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Jump Flip, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
144CF0B61216826C7F439B5C91A6ABD6

File PE Metadata
Compilation timestamp:
1/11/2015 7:51:00 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:+fcmhLlsosuE23UtV3s7wuBlCwjHdixnibVWajAnP0gQyez6Xjt6AlWEZ7Tfd5n7:+UmhJ/su3UPqXdiPa+0dZOTt6AToEF

Entry address:
0x20437

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, A1, 7E, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, B8, 2D, 8E, 02, 10, A3, 98, F2, 03, 10, C7, 05, 9C, F2, 03, 10, 23, 85, 02, 10, C7, 05, A0, F2, 03, 10, D7, 84, 02, 10, C7, 05, A4, F2, 03, 10, 10, 85, 02, 10, C7, 05, A8, F2, 03, 10, 79, 84, 02, 10, A3, AC, F2, 03, 10, C7, 05, B0, F2, 03, 10, A5, 8D, 02, 10, C7, 05, B4, F2, 03, 10, 95, 84, 02, 10, C7, 05, B8, F2, 03, 10, F7, 83, 02, 10, C7, 05, BC, F2, 03, 10, 83, 83...
 
[+]

Entropy:
6.4998

Code size:
196 KB (200,704 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to install.jumpflip.net  (70.186.131.184:80)

Remove f38ebc9ed8f43a5d5f09b98ce61f9c32.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.