home

savings ship-bg.exe

Savings Ship

Innovative Apps

This is part of a distribution package that is classified as adware distributed by 50onRed. This adware is used to interact with the installed web browsers and inject ads and modify the default search and homepages. The application savings ship-bg.exe by Innovative Apps has been detected as adware by 7 anti-malware scanners. This file is typically installed with the program Savings Ship by 215 Apps which is a potentially unwanted software program. Part of the Corssrider web browser platform, the BG executable is a background process that manage various function of the installed extensions in user's browser including managing installation, updates and remote code downloads.
Publisher:
Innovative Apps  (signed and verified)

Product:
Savings Ship

Description:
Savings Ship exe

Version:
1000.1000.1000.1000

MD5:
e9773f414982ca1ea6bccda788f0216f

SHA-1:
34b32ce88188bd347c6a4fd9ea02efbf0dfda0d4

SHA-256:
7b46e4297056f771bd76e308561eaaaa7d1b216ff24fed241669c9702e6bdd0b

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Browser extension that injects additional advertisements (banner and text links) on web pages.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Innovative Apps.

Analysis date:
4/23/2024 9:47:11 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Installer-M [Adw]
2014.9-141025

Dr.Web
Trojan.Crossrider.1
9.0.1.0298

ESET NOD32
Win32/Toolbar.CrossRider (variant)
8.8857

Kaspersky
not-a-virus:AdWare.Win32.Lyckriks
14.0.0.3046

Reason Heuristics
PUP.Crossrider.InnovativeApps.P
14.10.25.17

Vba32 AntiVirus
AdWare.Lyckriks
3.12.24.3

VIPRE Antivirus
GamePlayLabs
21960

File size:
878.9 KB (899,976 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
Savings Ship.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\savings ship\savings ship-bg.exe

Digital Signature
Signed by:
Innovative Apps

Authority:
Thawte, Inc.

Valid from:
1/8/2013 7:00:00 PM

Valid to:
1/9/2014 6:59:59 PM

Subject:
CN=Innovative Apps, O=Innovative Apps, L=Philadelphia, S=Pennsylvania, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
5419E32FDAD7A6E5666A35066C5EAAC5

File PE Metadata
Compilation timestamp:
6/10/2013 9:07:22 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:+tc2DxJQ5kIxaiGC53kYcaVpTe6osTzjW7d:+tc35kliGC53aaO6osTfW7d

Entry address:
0x76983

Entry point:
E8, 66, AD, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, E8, 80, 4D, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, EC, 80, 4D, 00, 5D, C3, 05, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8, 1B, C0, 23, C1, 83, C0, 08, 5D, C3, E8, 52, 0E, 00, 00, 85, C0, 75, 06, B8, 50, 82, 4D, 00, C3, 83, C0, 08, C3, E8, 3F, 0E, 00, 00, 85, C0, 75, 06, B8, 54, 82, 4D, 00, C3, 83, C0, 0C, C3, 8B, FF, 55, 8B, EC, 56, E8, E2, FF, FF, FF, 8B, 4D, 08...
 
[+]

Entropy:
6.5572

Code size:
711.5 KB (728,576 bytes)

The file savings ship-bg.exe has been discovered within the following program.

Savings Ship  by 215 Apps
This is an adware web browser extension by Innovative Apps (from 50onRed). From the TOS: "When installing the Plugin, it attempts to detect other software that may interfere with its functioning, usually similar types of software.
savingsship.com
81% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to a92-123-180-177.deploy.akamaitechnologies.com  (92.123.180.177:80)

Remove savings ship-bg.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.