home

sfulanql.exe

AcDc Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application sfulanql.exe by AcDc Project (BrightCircle Investments Limited) has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Fglwoqky LTD  (signed by AcDc Project (BrightCircle Investments Limited))

Description:
Xekjyrip

Version:
1.35.12.18

MD5:
67e3ff71014ca28f5ef6b61292cbf23b

SHA-1:
37b1582ed95742dcc33ed504110e59f1abb70141

SHA-256:
f79f4a558bdb39ef137f6782c00e5010a0be318bc7d08a34ed0e55136fa22972

Scanner detections:
25 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Analysis date:
4/26/2024 10:18:14 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.12588300
506

Agnitum Outpost
Riskware.VMDetector
7.1.1

AhnLab V3 Security
Win-PUP/CrossRider
2015.02.04

Avira AntiVirus
Adware/CrossRid.bqyp
7.11.206.190

avast!
NSIS:Crossrider-CY [PUP]
2014.9-150916

AVG
Generic
2016.0.2984

Dr.Web
Trojan.Crossrider.46916
9.0.1.0259

ESET NOD32
Win32/Toolbar.CrossRider.BM potentially unwanted (variant)
9.11116

Fortinet FortiGate
Riskware/CrossRider
9/16/2015

F-Secure
Trojan.Generic.12588300
11.2015-16-09_4

G Data
Script.Application.Plush
15.9.25

K7 AntiVirus
Unwanted-Program
13.193.14846

Kaspersky
not-a-virus:WebToolbar.Win32.CrossRider
14.0.0.1416

Malwarebytes
PUP.Optional.CrossRider.A
v2015.09.16.08

McAfee
Artemis!67E3FF71014C
5600.6640

MicroWorld eScan
Trojan.Generic.12588300
16.0.0.777

NANO AntiVirus
Trojan.Win32.MLW.dluhqt
0.30.0.65070

Qihoo 360 Security
Win32/Virus.Adware.285
1.0.0.1015

Reason Heuristics
Adware.BrightCircle.Fglwoqky.Installer (M)
15.9.16.20

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.15914

Sophos
AppRider
4.98

Trend Micro House Call
TROJ_GE.047F06A6
7.2.259

Trend Micro
ADW_CROSSRIDER
10.465.16

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Crossrider
37220

File size:
13.1 MB (13,736,184 bytes)

Copyright:
Copyright Exjehiluunalkd

Trademarks:
Solehgrvjb is a trademark of Mpprwswxchmtc

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\sfulanql.exe

Digital Signature
Signed by:
AcDc Project (BrightCircle Investments Limited)

Authority:
COMODO CA Limited

Valid from:
11/30/2014 10:00:00 PM

Valid to:
12/1/2015 9:59:59 PM

Subject:
CN=AcDc Project (BrightCircle Investments Limited), O=AcDc Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BB5CB272841409598560E8776848BBF4

File PE Metadata
Compilation timestamp:
12/4/2012 11:55:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
393216:eanGgsHzZN7W5d0UJbjhEQgo7ifBvYcnUg:ogsH1NqP0UJJE1BvYcnU

Entry address:
0x4323

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, C3, 44, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, C4, 44, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, C4, 44, 00, 56, A3, 40, 3B, 44, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, 9C, 3B, 44, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, C4, 44, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Code size:
34.5 KB (35,328 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to tlb.hwcdn.net  (69.16.175.10:80)

TCP (HTTP):
Connects to s3-website-us-east-1.amazonaws.com  (54.231.13.52:80)

TCP (HTTP):
Connects to hwcdn.net  (69.16.175.42:80)

TCP (HTTP):
Connects to ec2-23-21-109-148.compute-1.amazonaws.com  (23.21.109.148:80)

Remove sfulanql.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.