home

sfpsnew1_istartsurf.exe

1306_sfpsnew1_istartsurf

Li Mo

The application sfpsnew1_istartsurf.exe by Li Mo has been detected as adware by 15 anti-malware scanners. This is an adware bundler (AKA ElexNetDownload) that will include additional unwanted offers in the download and install process. During install it will establish a connection to twonext.com and xingcloud.com to determine what offers to show the user (based on what is already installed and where they live).It is also typically executed from an Internet Explorer cache folder.
Publisher:
File Syn  (signed by Li Mo)

Product:
1306_sfpsnew1_istartsurf

Description:
FileWork

Version:
6.1.7602.750

MD5:
fb3b4278ddaf4e3ea8a74a3309d4c28d

SHA-1:
93cd7cb15f099c0e0f3f3396038d3dbf948ca5f2

SHA-256:
0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4

Scanner detections:
15 / 68

Status:
Adware

Explanation:
Software bundler and update mechanism that will attempt to install adware offers.

Analysis date:
5/20/2024 1:53:46 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Mutabaha
7.1.1

AhnLab V3 Security
PUP/Win32.Downloader
2014.09.04

AVG
Generic
2015.0.3267

Baidu Antivirus
Adware.Win32.ELEX
4.0.3.14128

Dr.Web
Adware.Mutabaha.70
9.0.1.0269

ESET NOD32
Win32/ELEX.AX (variant)
8.10403

herdProtect (fuzzy)
variant of lly_webssearches.exe (Adware)
2014.12.8.10

IKARUS anti.virus
PUA.LiMo0
t3scan.1.7.8.0

Malwarebytes
PUP.Optional.SearchHijacker.A
v2014.09.26.01

McAfee
Artemis!2BE3144251E9
5600.6995

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
PUP.LiMo.T
14.9.26.13

Sophos
Generic PUA JD
4.98

Trend Micro House Call
Suspicious_GEN.F47V0907
7.2.269

VIPRE Antivirus
Elex Installer
32236

File size:
749.9 KB (767,864 bytes)

Product version:
6.1.7602.750

Copyright:
SynWork

Original file name:
SynWork.exe

File type:
Executable application (Win32 EXE)

Language:
English

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\sfpsnew1_istartsurf.exe

Digital Signature
Signed by:
Li Mo

Authority:
DigiCert Inc

Valid from:
8/4/2014 2:00:00 AM

Valid to:
8/12/2015 2:00:00 PM

Subject:
CN=Li Mo, O=Li Mo, L=Guilin, S=Guangxi, C=CN

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0F53999A8B9372F6AAC4844D7A5BE2CE

File PE Metadata
Compilation timestamp:
8/15/2014 4:01:10 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:R1HCq6pjUJjz1MlY7W16W1koLtBN+tXCJZjiqevn6UJKAX:RdCjUJjzIY7Wt1koNZjiJ6UJKAX

Entry address:
0x39207

Entry point:
E8, A5, E6, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 74, AA, 4A, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 48, 18, 4A, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, 74, AA, 4A, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03...
 
[+]

Packer / compiler:
PEQuake V0.06

Code size:
539 KB (551,936 bytes)

Remove sfpsnew1_istartsurf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.