» iwebar-firefoxinstaller.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (3)

iwebar-firefoxinstaller.exe

Goobzo LTD

The application iwebar-firefoxinstaller.exe by Goobzo has been detected as adware by 20 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program iWebar by iWebBar which is a potentially unwanted software program. The Firefox Installer is part of the Crossrider toolbar platform and is designed to install the Crossrider plugin within Mozilla Firefox. It will also manage the Firefox SQLite connectivity.

File name:

Publisher:

iWebar (signed by Goobzo LTD)

Product:

iWebar

Description:

iWebar exe

Version:

1000.1000.1000.1000

MD5:

b087ce946c8880833f0aa66ce1c8bbcf

SHA-1:

caa1c401bd295d688f68c3d17f18137667fa0efd

SHA-256:

ee39b8c2e2832739057977845e32b89f5bc4970b90241aa7bba91776a9f16ef6

Scanner detections:

20 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform. It will download and install the extension for Firefox.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Goobzo LTD.

Analysis date:

4/27/2024 1:15:59 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

Adware/CrossRider.A.1799

7.11.146.82

AVG

MalSign.Skodna

2014.0.3619

Baidu Antivirus

HackTool.Win32.CrossRider

4.0.3.1419

Boost by Reason

Optional.Task.Goobzo.X

188838

Comodo Security

UnclassifiedMalware

17384

Dr.Web

Trojan.Crossrider.950

9.0.1.060

Emsisoft Anti-Malware

JS:Trojan.Script.WF

8.14.08.08.02

ESET NOD32

Win32/Toolbar.CrossRider (variant)

8.9131

Fortinet FortiGate

Riskware/PUP_FEJ

1/9/2014

herdProtect (fuzzy)

variant of plus-hd-4.1-firefoxinstaller.exe (Adware)

2013.12.26.0

K7 AntiVirus

Trojan

13.174.10410

Malwarebytes

PUP.Optional.Lyrics.A

v2013.12.21.05

McAfee

PUP-FEJ!C6AE7182EAFE

5600.7255

Panda Antivirus

PUP/PlusHD

14.08.08.02

Qihoo 360 Security

Win32/Trojan.Adware.37e

1.0.0.1015

Reason Heuristics

PUP.Crossrider.Task.X

14.8.8.2

Sophos

Generic PUA BJ

4.95

Trend Micro House Call

TROJ_SPNR.3AKH13

7.2.357

Trend Micro

TROJ_SPNR.3AKH13

10.465.09

VIPRE Antivirus

Crossrider

24006

File size:

869.4 KB (890,224 bytes)

Product version:

1000.1000.1000.1000

Original file name:

iWebar.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\iwebar\iwebar-firefoxinstaller.exe

Digital Signature

Signed by:

Goobzo LTD

Authority:

Thawte, Inc.

Valid from:

5/1/2013 5:00:00 PM

Valid to:

5/2/2015 4:59:59 PM

Subject:

CN=Goobzo LTD, O=Goobzo LTD, L=Haifa, S=Israel, C=IL

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

120B25DDE57B88636AD4D97D23B99C88

File PE Metadata

Compilation timestamp:

12/11/2013 10:56:31 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:osOJ96XChwOCKxJx2H9Bx8VksaxrQqjCCVsATW:WSHLH2Vks4rQqjCCVsATW

Entry address:

0x92260

Entry point:

E8, 99, EF, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 57, 8B, 7B, 08, 33, 3D, F8, 81, 4D, 00, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8B, 07, 8D, 73, 10, 83, F8, FE, 74, 0D, 8B, 4F, 04, 03, CE, 33, 0C, 30, E8, 53, A1, FF, FF, 8B, 4F, 0C, 8B, 47, 08, 03, CE, 33, 0C, 30, E8, 43, A1, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, D0, 00, 00, 00, 89, 45, E8, 8B, 45, 10, 89, 45, EC, 8D, 45, E8, 89, 43, FC, 8B, 43, 0C, 89, 45, F8, 83, F8, FE, 0F, 84, EE, 00... 
[+]

Entropy:

6.5563

Code size:

710 KB (727,040 bytes)

Scheduled Task

Task name:

iWebar-firefoxinstaller

Trigger:

Logon (Runs on logon)

The file iwebar-firefoxinstaller.exe has been discovered within the following program.

iWebar by iWebBar

iWebar is a web browser extension and toolbar that delivers contextual based advertising as well as modify the user's web browser home and search pages to provide advertising and search.

80% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to update.srvstatsdata.com (69.16.175.42:80)

http://update.srvstatsdata.com/installer_updates/009016/update.json

TCP (HTTP):

Connects to stats.srvstatsdata.com (176.32.99.41:80)

TCP (HTTP):

Connects to app-static.crossrider.com (69.16.175.10:80)

Remove iwebar-firefoxinstaller.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.