» SearchSettings.exe
Overview
Analysis
File Details
Behaviors (1)
Network (1)

SearchSettings.exe

Widgi Toolbar

Spigot, Inc.

This component is part of the Spigot browser add-on, a web browser addition that is designed to modify the core search provider in order to redirect search queries through partner portals. The application SearchSettings.exe by Spigot has been detected as adware by 9 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘SearchSettings’. While running, it connects to the Internet address 14.d7.24ae.ip4.static.sl-reverse.com on port 80 using the HTTP protocol.

File name:

SearchSettings.exe

Publisher:

Spigot, Inc. (signed and verified)

Product:

Widgi Toolbar

Description:

Search Settings

Version:

7, 3, 0, 2

MD5:

da096877bf07ca500b190bb85fa6936e

SHA-1:

a7f8d70816b7a109c3e547aac73d1b96ec5166a5

SHA-256:

6037b0a5ec8adca7a7d4d8581cf0ab55d780987c632c3726f45dd84813969686

Scanner detections:

9 / 68

Status:

Adware

Analysis date:

4/26/2024 3:02:25 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

TR/Drop.Softomat.AN

7.11.30.172

Baidu Antivirus

Adware.Win32.Widgi

4.0.3.1487

Boost by Reason

Optional.Startup.Spigot.O

188838

Dr.Web

Trojan.Damaged.1

9.0.1.0219

Emsisoft Anti-Malware

Riskware.Win32.Toolbar.Widgi.AMN

8.14.02.11.11

ESET NOD32

Win32/Toolbar.Widgi (variant)

7.9155

Reason Heuristics

PUP.Startup.Spigot.O

14.8.7.21

SUPERAntiSpyware

Trojan.Agent/Gen-Nullo[Short]

10435

Trend Micro House Call

TROJ_GEN.F47V0716

7.2.207

File size:

1.2 MB (1,303,360 bytes)

Product version:

7, 3, 0, 2

Original file name:

SearchSettings.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\common files\spigot\search settings\searchsettings.exe

Digital Signature

Signed by:

Spigot, Inc.

Authority:

VeriSign, Inc.

Valid from:

2/25/2012 4:00:00 PM

Valid to:

3/28/2015 4:59:59 PM

Subject:

CN="Spigot, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Spigot, Inc.", L=El Granada, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

494FF8E91607158CD480B23C615CFF8B

File PE Metadata

Compilation timestamp:

7/5/2013 2:27:24 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:pXzp79rZovX/5Ktv9bLgsVkAzxaQhYer6O5YOaj7P6L:pXzp7LC/5KtvxMsqAzxaLq12Oaj7P6L

Entry address:

0x8C131

Entry point:

E8, D9, 8F, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, A3, 10, A5, 4D, 00, 5D, C3, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A1, 98, 63, 4D, 00, 33, C5, 89, 45, FC, 83, A5, D8, FC, FF, FF, 00, 53, 6A, 4C, 8D, 85, DC, FC, FF, FF, 6A, 00, 50, E8, B9, EA, FF, FF, 8D, 85, D8, FC, FF, FF, 89, 85, 28, FD, FF, FF, 8D, 85, 30, FD, FF, FF, 83, C4, 0C, 89, 85, 2C, FD, FF, FF, 89, 85, E0, FD, FF, FF, 89, 8D, DC, FD, FF, FF, 89, 95, D8, FD, FF, FF, 89, 9D, D4, FD, FF, FF, 89, B5, D0, FD, FF, FF, 89... 
[+]

Entropy:

5.8226

Code size:

706.5 KB (723,456 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

SearchSettings

Command:

"C:\Program Files\common files\spigot\search settings\searchsettings.exe"

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to 14.d7.24ae.ip4.static.sl-reverse.com (174.36.215.20:80)

Remove SearchSettings.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.