f84a756b-f6d5-4587-9644-afe95b179fb3-5.exe

HD_Quality_v1.1

Motoko Group

This adware utilizes the Crossrider extension platform and will inject advertisiments in the Internet browser and may modify core browser settings. Ads will be delivered as banners and contextual text-links and may promote other potentially unwanted software. The application f84a756b-f6d5-4587-9644-afe95b179fb3-5.exe, “HD_Quality_v1.1 exe” by Motoko Group has been detected as adware by 22 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This will display various ads in the web browser such as popups, interstitial and in-text links and distributed through various monetization platforms. It will also modify browser settings such as the search and home page. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
HD_Quality  (signed by Motoko Group)

Product:
HD_Quality_v1.1

Description:
HD_Quality_v1.1 exe

Version:
1000.1000.1000.1000

MD5:
2d3e1e4e79b2f1ab055e9770c7879080

SHA-1:
b3e77746a8c8a29b56456cb8385f48b712ed8a0e

SHA-256:
9c5382e3d815c342a33ff1d374bb5671b5cefdbe0ad4756483eccb9bbcd5a619

Scanner detections:
22 / 68

Status:
Adware

Explanation:
May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:
4/19/2024 4:39:33 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Kazy.374109
857

AhnLab V3 Security
PUP/Win32.CrossRider
2014.07.31

Avira AntiVirus
ADWARE/CrossRider.Gen2
7.11.164.150

avast!
Win32:Adware-gen [Adw]
2014.9-141001

AVG
Generic
2015.0.3335

Bitdefender
Gen:Variant.Adware.Kazy.374109
1.0.20.1370

Emsisoft Anti-Malware
Gen:Variant.Adware.Kazy.374109
8.14.10.01.12

ESET NOD32
Win32/Toolbar.CrossRider.AH (variant)
8.10178

Fortinet FortiGate
W32/GoogUpdate.AH!tr
10/1/2014

F-Secure
Gen:Variant.Adware.Kazy.374109
11.2014-01-10_4

G Data
Gen:Variant.Adware.Kazy.374109
14.10.24

IKARUS anti.virus
not-a-virus:WebToolbar.CrossRider
t3scan.1.6.1.0

Kaspersky
Trojan.NSIS.GoogUpdate
14.0.0.3170

Malwarebytes
PUP.Optional.PlusHD.A
v2014.10.01.12

McAfee
Artemis!1A4076DA6E48
5600.6991

MicroWorld eScan
Gen:Variant.Adware.Kazy.374109
15.0.0.822

Panda Antivirus
Trj/Genetic.gen
14.10.01.12

Reason Heuristics
PUP.MotokoGroup.g
14.8.10.14

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.14929

Sophos
Generic PUA DO
4.98

VIPRE Antivirus
Threat.4789396
31208

File size:
470.9 KB (482,152 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
HD_Quality_v1.1.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\hd_quality_v1.1\f84a756b-f6d5-4587-9644-afe95b179fb3-5.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
7/17/2014 9:00:00 PM

Valid to:
7/18/2015 8:59:59 PM

Subject:
CN=Motoko Group, O=Motoko Group, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AAFC4F8011F7FD7C00748C990950D28A

File PE Metadata
Compilation timestamp:
7/28/2014 8:08:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:brdDoo+82gE/MM9P2KVHBy3KHfRc/7jWxvugzt18pTBUkeJdOLakIk:bZv2gE/MMc2HBy3K5cH6Bzv8pTOZdpk

Entry address:
0x3CFC6

Entry point:
E8, 0F, CB, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, F8, 14, 47, 00, E8, 04, 4A, 00, 00, E8, 78, 1D, 00, 00, 0F, B7, F0, 6A, 02, E8, A2, CA, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, C0, 87, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
372 KB (380,928 bytes)

Scheduled Task
Task name:
f84a756b-f6d5-4587-9644-afe95b179fb3-5

Trigger:
Logon (Runs on logon)

Action:
f84a756b-f6d5-4587-9644-afe95b179fb3-5.exe \qbutmyhs \iuxorwrzw='hd_quality_v1.1' \qyfallvcr=


The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ip-50-63-202-32.ip.secureserver.net  (50.63.202.32:80)

Remove f84a756b-f6d5-4587-9644-afe95b179fb3-5.exe - Powered by Reason Core Security