» Search Safer Inc.
Digital Signature
Analysis
Files (27)
Downloads (6)
Domains (1)
Distribution (5)
Related (59)

Search Safer Inc.

Publisher Information

Search Safer Inc. is a software developer located in San Francisco, California in the United States*. The company is a primary distributor of unwanted software. Search Safer is part of the Zako Solutions brand of monetization products that are designed to distribute web browser toolbars, non-search offers and in-app purchases through freeware and shareware software. Zako/Search Safe is run by Yossi Fishler located at 450 Townsend in San Francisco, CA 94107. Thre are 21 additional code signing certificates issued to this publisher.

Authority:

DigiCert Inc

Valid from:

4/17/2014 8:00:00 PM

Valid to:

2/10/2016 7:00:00 AM

Subject:

CN=Search Safer Inc., O=Search Safer Inc., L=San Francisco, S=California, C=US, PostalCode=94107, STREET=665 3rd st, STREET=suite 150, SERIALNUMBER=5189473, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:

CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0a4669f7321bbb3215a68123f91e80bd

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Service.SearchSafer.F, PUP.Startup.SearchSafer.H, PUP.SearchSafer.M, PUP.SearchSafer.Q, PUP.SearchSafer.L, PUP.SearchSafer.B, PUP.SearchSafer.N, PUP.SearchSafer.F, PUP.Installer.SearchSafer.M, PUP.SearchSafer.Installer (M), PUP.SearchSa (M), PUP.SearchSa.Installer (M), PUP (M)

100.00%

Dr.Web

Adware.Downware.3008

29.63%

Malwarebytes

PUP.Optional.Conduit.A, PUP.Optional.SearchSafer.A

25.93%

ESET NOD32

Win32/Toolbar.Conduit, Win32/AdWare.SmartApps, Win32/Toolbar.Conduit.R potentially unwanted

25.93%

avast!

Win32:Malware-gen, Win32:Adware-gen [Adw], Win32:Dropper-gen [Drp]

22.22%

Kaspersky

not-a-virus:Downloader.NSIS.Agent, not-a-virus:WebToolbar.Win32.Agent

22.22%

Vba32 AntiVirus

Downloader.Agent, suspected of Trojan.Downloader.gen.h

22.22%

AVG

Toolbar.Conduit, Win32/DH, SearchSafer

22.22%

Comodo Security

Application.Win32.Conduit.~A

18.52%

VIPRE Antivirus

Conduit, Search Safer

18.52%

1 / 68 (Adware)

content.003 (68b182a13abebaa342cd6136439a54b3)

4 / 68 (Adware)

tmp0000000712f0652218b5cdd3 (af40559bbfcea937007f1ce0cf91c656)

1 / 68 (Adware)

file_to_run551492.exe (f53c993ce954ae2e654671476d5d5814)

1 / 68 (Adware)

a.exe (d33e3859c24662b689a7302c9055f07f)

1 / 68 (Adware)

file_13107.exe (0913aa64fdb8e569dce003dc624cca9b)

21 / 68 (Adware)

file_27585.exe (026185f34125430ee9881a0d5e26ab8c)

14 / 68 (Adware)

white.exe (8048cbb6a93d7dedeac821fa6278c44c)

16 / 68 (Adware)

file_1898054918.exe (bf22782aaea1131f26a806d9b7defe6c)

1 / 68 (Adware)

andy-0.21-x86.exe (Andy by GreatFruit) (abd4c42135215e0981a89e9b43c20c8a)

2 / 68 (Adware)

speedmax_20140425.exe (3c3a664bd1db83cecc7e7b037ff0c0bd)

15 / 68 (Adware)

file_20876.exe (b93ee2ccdf7ee21d6bcb7f3619a7dd0d)

4 / 68 (Adware)

yuvideoinstaller.exe (YUVIDEO Converter by yuvideo.com) (368aab5324af95dd83c425db83d59f74)

1 / 68 (Adware)

andy-0.21-x64.exe (Andy by GreatFruit) (88f9e5efdcbfe3840d8d2068bf0a6318)

1 / 68 (Adware)

a.exe (d33e3859c24662b689a7302c9055f07f)

1 / 68 (Adware)

inetc.dll (f0168e3e9dd058e194059f6fad94467d)

2 / 68 (Adware)

file_to_run55575.exe (ebb7743a247a49c612af5963548a2b0a)

5 / 68 (Adware)

file_10490992.exe (9920c1e88533f5ea2ab4e505de91be14)

3 / 68 (Adware)

file_163623.exe (06e23e85b7a997ceafd2bfc7d7929fd0)

2 / 68 (Adware)

service.exe (092e2beb0fd18d670ce2bfa361fb89ee)

1 / 68 (Adware)

pcreg.exe (1b7464e530d6fb7a9f94613b33662eb1)

2 / 68 (Adware)

file_to_run55703.exe (e58b18a04b260db666f2836a4a3708a3)

1 / 68 (Adware)

a.exe (41260ef7f760c3a46795eb98abf329f5)

2 / 68 (Adware)

file_154328.exe (c8b92f3d4afefbabf1edf80a41e675eb)

10 / 68 (Adware)

file_to_run55992.exe (ca483dfbf5ce23aa65793ca37e0b6a4b)

1 / 68 (Adware)

taskinst2000.exe (d0738fe6bd0d0dc31333282531c8d579)

2 / 68 (Adware)

service.exe (ea989bb3a5e69f0dcad9864e54eb1e87)

1 / 68 (Adware)

pcreg.exe (3fa8842bdec6f65da0c6c6c2b384b7c4)

Downloads URLs for files signed by Search Safer Inc..

1 / 68 (Adware)

https://d2kfsynn8a76li.cloudfront.net/.../taskinst2000.exe (d0738fe6bd0d0dc31333282531c8d579)

3 / 68 (Adware)

http://d2kfsynn8a76li.cloudfront.net/.../taskinst2023.exe (06e23e85b7a997ceafd2bfc7d7929fd0)

2 / 68 (Adware)

https://d2cga0idq39sb9.cloudfront.net/.../onredUS101.exe (e58b18a04b260db666f2836a4a3708a3)

1 / 68 (Adware)

https://d2sci4fopfy9a2.cloudfront.net/.../Andy-0.21-x64.exe (88f9e5efdcbfe3840d8d2068bf0a6318)

1 / 68 (Adware)

http://www.andyroid.net/getandy.php (andy-0.21-x64.exe)

1 / 68 (Adware)

http://bit.ly/getAndy (andy-0.21-x64.exe)

Domains

Top-level domains owned by Search Safer Inc..

zakosolutions.com

Distribution

The following websites host and distribute files published by Search Safer Inc..

d2kfsynn8a76li.cloudfront.net

d2cga0idq39sb9.cloudfront.net

d2sci4fopfy9a2.cloudfront.net

www.andyroid.net

bit.ly

The certificates below are also signed by Search Safer Inc..

0CABF6C1133DB05A8B40B85F31CD94A9 (Mar 13, 2014 to Feb 10, 2016)

0403B9226C3448CDB32080CC686AB22C (Dec 04, 2012 to Feb 10, 2016)

0A53F7529B6130A6628AC1B79257FCA8 (May 20, 2014 to Feb 10, 2016)

04D4B772CA1293BC1799E2A2ACB014DC (Mar 18, 2014 to Feb 10, 2016)

025FF57ABB946C9380A9E34424A2279E (May 11, 2014 to Feb 10, 2016)

01F4A28590DA3F29E2D2451549E04626 (Apr 27, 2014 to Feb 10, 2016)

0DD45460B26C36827A94ED3E5121F830 (Apr 09, 2014 to Feb 10, 2016)

0D397E40D32ACA9E1EEF917E9C9DDE39 (May 05, 2014 to Feb 10, 2016)

0A9503052352494760E64F027ED81BDA (Jan 06, 2014 to Feb 10, 2016)

0FB2AC8CD06CF9C5F2569B9DEBE2D0AE (Mar 27, 2014 to Feb 10, 2016)

10 of 21 code signing certificates issued

The following publishers (by Authenticode signature organization name) are related.

30 of 59 publishers

* Note, the details and description above are based on the code signing digital signature issued to Search Safer Inc. by DigiCert Inc on April 17, 2014 with the serial number '0a4669f7321bbb3215a68123f91e80bd'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.