feven 1.1-firefoxinstaller.exe

Feven 1.1

Brightcircle Investments Limited

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application feven 1.1-firefoxinstaller.exe by Brightcircle Investments Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. The Firefox Installer is part of the Crossrider toolbar platform and is designed to install the Crossrider plugin within Mozilla Firefox. It will also manage the Firefox SQLite connectivity. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Feven  (signed by Brightcircle Investments Limited)

Product:
Feven 1.1

Description:
Feven 1.1 exe

Version:
1000.1000.1000.1000

MD5:
5928287a6627b099e6b341aecbbc680f

SHA-1:
cd535ee779fab80765ef58a34774758710e68059

SHA-256:
4afc01511d8237ceef902ab69ba517ebeb851de76477c573cd5441bf3f269303

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Part of the Crossrider toolbar platform. It will download and install the extension for Firefox. Distributed through the Brightcircle investments brand.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Brightcircle Investments Limited.

Analysis date:
4/26/2024 11:40:05 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Crossrider.Brightcircle.Installer (M)
16.2.14.21

File size:
749.9 KB (767,848 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
Feven 1.1.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\feven 1.1\feven 1.1-firefoxinstaller.exe

Digital Signature
Authority:
GoDaddy.com, Inc.

Valid from:
3/8/2013 10:33:54 AM

Valid to:
3/8/2016 10:33:54 AM

Subject:
CN=Brightcircle Investments Limited, O=Brightcircle Investments Limited, L=Nicosia, S=Strovolos, C=CY

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
047F36483DC84C

File PE Metadata
Compilation timestamp:
11/3/2013 7:06:57 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:IV0YHvFO/4QYYzuPO3b6GhZ1TznxHhHAGafETIAvg9PBXMqAdwLpTKGOV:IV0YH9upEcb6YPTznxHhGET1vTqVTKD

Entry address:
0x7CC99

Entry point:
E8, 7C, C5, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, B8, 59, 4B, 00, E8, 11, 45, 00, 00, E8, D3, 1D, 00, 00, 0F, B7, F0, 6A, 02, E8, 0F, C5, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 93, 73, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
607 KB (621,568 bytes)

Scheduled Task
Task name:
Feven 1.1-firefoxinstaller

Trigger:
Logon (Runs on logon)


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to update.srvstatsdata.com  (69.16.175.42:80)

 
http://update.srvstatsdata.com/installer_updates/009147/update.json

TCP (HTTP):
Connects to stats.srvstatsdata.com  (176.32.99.41:80)

TCP (HTTP):
Connects to app-static.crossrider.com  (69.16.175.10:80)

Remove feven 1.1-firefoxinstaller.exe - Powered by Reason Core Security