» radio canyon-codedownloader.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (2)

radio canyon-codedownloader.exe

Porter Studio Plus

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application radio canyon-codedownloader.exe by Porter Studio Plus has been detected as adware by 37 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Radio Canyon by Bright circle investments Ltd. which is a potentially unwanted software program. Built using the Crossrider web brower toolkit the CodeDownloader component will automatically connnect to the remote API server and download additional code/components for Radio Canyon extension/toolbar. The component makes a number of requests to the host app-static.crossrider.com/plugins/.../monetization/monetizationLoader.js. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

Publisher:

Radio Canyon (signed by Porter Studio Plus)

Product:

Radio Canyon

Description:

Radio Canyon exe

Version:

1000.1000.1000.1000

MD5:

463970ac7d1b5bfca317107d21fd2a6a

SHA-1:

527b453c2021df5765864006b65b3f9a9b573f1a

SHA-256:

ab0233d3e4aa54034989760c3a3e85148caf9f28591485ed8507cfb44f311bb2

Scanner detections:

37 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Porter Studio Plus.

Analysis date:

5/5/2024 8:54:55 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Zusy.105499

823

AegisLab AV Signature

AdWare.MSIL.DomaIQ

2.1.4+

AhnLab V3 Security

PUP/Win32.CrossRider

2014.09.28

Avira AntiVirus

ADWARE/CrossRider.Gen4

7.11.181.56

avast!

Win32:Crossrider-AI [PUP]

141025-0

AVG

Generic

2015.0.3306

Baidu Antivirus

Adware.Win32.CrossAd

4.0.3.14113

Bitdefender

Gen:Variant.Adware.Zusy.105499

1.0.20.1535

Clam AntiVirus

Win.Adware.Agent-12356

0.98/21411

Comodo Security

ApplicUnwnt

19788

Dr.Web

Trojan.Crossrider.37155

9.0.1.0303

Emsisoft Anti-Malware

Gen:Variant.Adware.Zusy.105499

8.14.11.03.09

ESET NOD32

Win32/Toolbar.CrossRider.AY (variant)

8.10620

Fortinet FortiGate

Adware/Adwapper

11/3/2014

F-Prot

W32/A-1a27c920

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.Zusy.105499

11.2014-03-11_2

G Data

Win32.Adware.Crossrider

14.10.24

IKARUS anti.virus

PUA.CrossRider

t3scan.1.7.8.0

K7 AntiVirus

Unwanted-Program

13.183.13584

Kaspersky

not-a-virus:WebToolbar.Win32.CrossRider

14.0.0.3001

Malwarebytes

PUP.Optional.RadioCanyon.A

v2014.10.30.12

McAfee

Artemis!2ED38C936156

5600.6957

Microsoft Security Essentials

Threat.Undefined

1.187.339.0

MicroWorld eScan

Gen:Variant.Adware.Zusy.105499

15.0.0.921

NANO AntiVirus

Trojan.Win32.Crossrider.dhbrtw

0.28.2.62841

Norman

Sality.ZHB

11.20141103

Panda Antivirus

Trj/Genetic.gen

14.11.03.09

Qihoo 360 Security

HEUR/QVM10.1.Malware.Gen

1.0.0.1015

Quick Heal

AdWare.NSIS.r5 (Not a Virus)

11.14.14.00

Reason Heuristics

PUP.Crossrider.Task.BB

14.11.3.21

Rising Antivirus

PE:Trojan.Win32.Generic.175C6496!391931030

23.00.65.141101

Sophos

Generic PUA CB

4.98

Trend Micro House Call

TROJ_GEN.F0C2H00IC14

7.2.307

Trend Micro

PE_SALITY.ER

10.465.03

Vba32 AntiVirus

AdWare.Adwapper

3.12.26.3

VIPRE Antivirus

Threat.4789396

34232

Zillya! Antivirus

Adware.Adwapper.Win32.49

2.0.0.1928

File size:

1.1 MB (1,117,600 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Radio Canyon.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\radio canyon\radio canyon-codedownloader.exe

Digital Signature

Signed by:

Porter Studio Plus

Authority:

COMODO CA Limited

Valid from:

10/19/2014 7:00:00 PM

Valid to:

10/20/2015 6:59:59 PM

Subject:

CN=Porter Studio Plus, O=Porter Studio Plus, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00B7BA41CFBA8D50AF9A2A64362C08FA91

File PE Metadata

Compilation timestamp:

10/29/2014 3:36:20 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:A/w7h3onCWxBrtgifKwrlLGtqma2NUpS3EjTNt:A/w7GnDHglwwU2NUpS3EjTNt

Entry address:

0x9E6F2

Entry point:

E8, 3D, 03, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, 8B, 4C, 24, 0C, 57, 85, C9, 0F, 84, 92, 00, 00, 00, 56, 53, 8B, D9, 8B, 74, 24, 14, F7, C6, 03, 00, 00, 00, 8B, 7C, 24, 10, 75, 0B, C1, E9, 02, 0F, 85, 85, 00, 00, 00, EB, 27, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 83, E9, 01, 74, 2B, 84, C0, 74, 2F, F7, C6, 03, 00, 00, 00, 75, E5, 8B, D9, C1, E9, 02, 75, 61, 83, E3, 03, 74, 13, 8A, 06, 83, C6, 01, 88, 07, 83, C7, 01, 84, C0, 74, 37, 83, EB, 01, 75, ED, 8B, 44, 24, 10, 5B, 5E, 5F, C3, F7, C7, 03, 00... 
[+]

Entropy:

6.5607

Code size:

793 KB (812,032 bytes)

Scheduled Task

Task name:

d27d98cf-e794-4cff-af62-6b907bb1b094-1

Trigger:

Logon (Runs on logon)

Action:

radio canyon-codedownloader.exe \rawdata=ez45qljjndxm6yclx0fwx9ynitf4f\6vos+9gvklj

The file radio canyon-codedownloader.exe has been discovered within the following program.

Radio Canyon by Bright circle investments Ltd.

Radio Canyon (Porter Studio Plus) is an adware program (supported by various types of advertising) that is usually bundled by third party installers and download managers.

88% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to s3-website-us-east-1.amazonaws.com (52.216.0.146:80)

Remove radio canyon-codedownloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.