home

jzipmediabar.exe

Music Search App (Dist. by Bandoo Media, Inc.)

IAC Search and Media

This installer is part of the Ask.com (APN) network which will install the Ask.com branded toolbar or browser extension which will take control of the web browser's search functions. The application jzipmediabar.exe, “Music Search App (Dist. by Bandoo Media, Inc.) Installer” by IAC Search and Media has been detected as a potentially unwanted program by 16 anti-malware scanners. The program is a setup application that uses the APN Stub installer. This version of the installer will bundle the Ask.com Toolbar, a potentially unwanted web browser extension.
Publisher:
IAC Search and Media, Inc.  (signed by IAC Search and Media)

Product:
Music Search App (Dist. by Bandoo Media, Inc.)

Description:
Music Search App (Dist. by Bandoo Media, Inc.) Installer

Version:
2.9.0.0

MD5:
113db2d5f8a2387fba256c8377838749

SHA-1:
8860d67cd583c6d37158c94adcbcb045242fd396

SHA-256:
25d07f7dd97e86889d0e0cd85d7515b2e8a3c6a0c4ab7812591762feacbce110

Scanner detections:
16 / 68

Status:
Potentially unwanted

Explanation:
Bundles that Ask.com toolbar as a third-party offer, a web browser extension that may modify a user's search and home pages.

Analysis date:
5/4/2024 4:34:35 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Visicom
7.1.1

AVG
Search
2016.0.2921

Bkav FE
W32.HfsAdware
1.3.0.7237

Dr.Web
Adware.Toolbar.246
9.0.1.0322

ESET NOD32
Win32/Bundled.Toolbar.Ask.K potentially unsafe (variant)
9.12359

Fortinet FortiGate
Riskware/Visicom
11/18/2015

K7 AntiVirus
Unwanted-Program
13.210.17429

Malwarebytes
PUP.Optional.SearchApp
v2015.11.18.05

NANO AntiVirus
Riskware.Win32.SearchSuite.dwtfou
0.30.26.3725

Panda Antivirus
PUP/SearchResultsToolbar
15.11.18.05

Quick Heal
PUA.MSJDGBTIR.OD6
11.15.14.00

Reason Heuristics
PUP.Ask.IACSearchandMedia.Installer (M)
15.11.18.17

Rising Antivirus
PE:AdWare.Win32.IACSearch.d!1615102[F1]
23.00.65.151116

Sophos
Generic PUA BE (PUA)
4.98

VIPRE Antivirus
Trojan.Win32.Generic
44304

Zillya! Antivirus
Adware.SearchSuite.Win32.416
2.0.0.2428

File size:
3.3 MB (3,485,800 bytes)

Product version:
2.9.0.0

Copyright:
(c) 2012-2014 IAC Search and Media, Inc. All Rights Reserved

File type:
Executable application (Win32 EXE)

Installer:
APN Stub

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\nss25dd.tmp\jzipmediabar.exe

Digital Signature
Signed by:
IAC Search and Media

Authority:
VeriSign, Inc.

Valid from:
1/22/2014 7:00:00 PM

Valid to:
10/20/2015 7:59:59 PM

Subject:
CN=IAC Search and Media, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=IAC Search and Media, L=Oakland, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5367F5135FCC8B151C3E3EE4BEFD1DFB

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:bPc68tGHcUBsXV0LSzP11CXfbB0jHErgOyuZlLf:EtGHcUBsyLeP11LkrHplb

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9986

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 74.113.237.189.lv.iaccap.com  (74.113.237.189:80)

TCP (HTTP):
Connects to a23-52-155-27.deploy.static.akamaitechnologies.com  (23.52.155.27:80)

Remove jzipmediabar.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.