home

koala personal search-firefoxinstaller.exe

Skyter Technologies Ltd.

The application koala personal search-firefoxinstaller.exe, “Koala Personal Search exe” by Skyter Technologies has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. The Firefox Installer is part of the Crossrider toolbar platform and is designed to install the Crossrider plugin within Mozilla Firefox. It will also manage the Firefox SQLite connectivity.
Publisher:
Koala Personal Search  (signed by Skyter Technologies Ltd.)

Product:
Koala Personal Search

Description:
Koala Personal Search exe

Version:
1000.1000.1000.1000

MD5:
5143ac0ec8bf81dff339342052efbe2e

SHA-1:
d1b646108a8befb2091204de8802abe466a082a7

SHA-256:
9af43386fa6046c6871b44b095693cadba2681a06442a25cf63541ab2c2dadd6

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Part of the Crossrider toolbar platform. It will download and install the extension for Firefox.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Skyter Technologies Ltd..

Analysis date:
4/25/2024 6:49:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Crossrider (M)
16.12.31.7

File size:
869.4 KB (890,264 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
Koala Personal Search.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\koala personal search\koala personal search-firefoxinstaller.exe

Digital Signature
Signed by:
Skyter Technologies Ltd.

Authority:
Thawte, Inc.

Valid from:
8/22/2012 5:00:00 PM

Valid to:
8/23/2014 4:59:59 PM

Subject:
CN=Skyter Technologies Ltd., O=Skyter Technologies Ltd., L=Tel Aviv-Jaffa, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
436F5CF769692509772EC6E9ED6B3227

File PE Metadata
Compilation timestamp:
12/11/2013 10:56:31 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

Entry address:
0x92260

Entry point:
E8, 99, EF, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 57, 8B, 7B, 08, 33, 3D, F8, 81, 4D, 00, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8B, 07, 8D, 73, 10, 83, F8, FE, 74, 0D, 8B, 4F, 04, 03, CE, 33, 0C, 30, E8, 53, A1, FF, FF, 8B, 4F, 0C, 8B, 47, 08, 03, CE, 33, 0C, 30, E8, 43, A1, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, D0, 00, 00, 00, 89, 45, E8, 8B, 45, 10, 89, 45, EC, 8D, 45, E8, 89, 43, FC, 8B, 43, 0C, 89, 45, F8, 83, F8, FE, 0F, 84, EE, 00...
 
[+]

Entropy:
6.5567

Code size:
710 KB (727,040 bytes)

Scheduled Task
Task name:
Koala Personal Search-firefoxinstaller

Trigger:
Logon (Runs on logon)


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to update.srvstatsdata.com  (69.16.175.42:80)

 
http://update.srvstatsdata.com/installer_updates/003015/update.json

TCP (HTTP):
Connects to stats.srvstatsdata.com  (176.32.99.41:80)

TCP (HTTP):
Connects to app-static.crossrider.com  (69.16.175.10:80)

Remove koala personal search-firefoxinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.