WhiteSmoke Inc

Publisher Information

WhiteSmoke Inc is a software publisher located in New York, United States*. The company is a primary distributor of unwanted software. WhiteSmoke based in Israel is a toolbar company that provides translation and grammar checking services within its toolbar products. Typically WhiteSmoke developes a customized Conduit toolbar in which it gets payments for each toolbar installed. Thre are 4 additional code signing certificates issued to this publisher.
Authority:
VeriSign, Inc.

Valid from:
6/28/2011 8:00:00 PM

Valid to:
7/7/2013 7:59:59 PM

Subject:
CN=WhiteSmoke Inc, OU=R&D, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=WhiteSmoke Inc, L=New York, S=New York, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
64048d72f9ffef12a43fc4f4cea580e3

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.WhiteSmoke.Y, PUP.Installer.WhiteSmoke.L, PUP.WhiteSmoke.DD, PUP.Installer.WhiteSmoke.EE, PUP.WhiteSmoke.K, PUP.WhiteSmoke.Installer, PUP.WhiteSmoke.Installer (M), PUP.WhiteSmoke.Amonetize.Installer (M), PUP.WhiteSmoke (M), PUP.WhiteSmoke.InstallCoreC.Installer (M), PUP.WhiteSmoke.InstallBrain.Installer (M)
100.00%

ESET NOD32
Win32/InstallCore (variant), Win32/Amonetize (variant), Win32/WhiteSmoke (variant), Win32/bProtector (variant), Win32/Obfuscated.NEU (variant)
58.00%

Dr.Web
Adware.InstallCore.3, Adware.Downware.1201, Adware.Downware.725, Adware.Downware.314, Adware.Toolbar.4, Adware.Downware.1457
44.00%

avast!
Win32:InstallCore-BA [PUP], Win32:Dropper-gen [Drp], Win32:WhiteSmoke-A [PUP], Win32:InstallCore-AZ [PUP], Win32:Amonetize-KM [PUP]
34.00%

Avira AntiVirus
ADWARE/InstallCore.Gen, APPL/WhiteSmoke.N, TR/Obfuscated.NEU.21, ADWARE/Adware.Gen2, APPL/WhiteSmoke.AL, PUA/InstallCore.Gen
32.00%

VIPRE Antivirus
Trojan.Win32.Generic, Amonetize, Bprotector, InstallBrain, WhiteSmoke (not malicious), Threat.4785227
32.00%

Sophos
Amonetize, InstallBrain, Install Core Installer, Virus 'Mal/EncPk-AAK', PUA 'Amonetize', Amonetize (PUA)
32.00%

Malwarebytes
Adware.Agent, Adware.InstallBrain, PUP.Optional.Amonetize.A, PUP.Optional.Amonetize.AS
30.00%

Comodo Security
Heur.Suspicious, UnclassifiedMalware, ApplicUnwnt
28.00%

Jiangmin
Trojan/JmGeneric.aee, AdWare/WhiteSmoke.ecl, TrojanDropper.Injector.dif, Trojan/Menti.pcq
26.00%

1 / 68      (Adware)
component_470.decrpt  (1868c20fd7e7f8eaa097ae09bb9d5101)

1 / 68      (Adware)
_te25de.exe (InstallBrain Installer by InstallBrain)  (c5baa99650da672ad7148bc6e15463b6)

1 / 68      (Adware)

1 / 68      (Adware)
whitesmoke2011-6008.exe (WhiteSmoke 2011 by Whitesmoke)  (1cc6f0948e049925ebf27bb9ef66e746)

1 / 68      (Adware)
whitesmoke2011-6008.exe (WhiteSmoke 2011 by Whitesmoke)  (f75a888ab6ce7f8b23621e9ed6300dd4)

1 / 68      (Adware)
whitesmoke_2011.cf  (d561d3ee822a177747a476579988a170)

1 / 68      (Adware)

1 / 68      (Adware)
whitesmoke.exe (Installer Module)  (1c4539d0508d5a52ccfc458f8fe042e0)

1 / 68      (Adware)

1 / 68      (Adware)
component_68.decrpt  (4f96e5f6411199f72295c91791ed48be)

1 / 68      (Adware)
setup__423.exe (Installer by Amonetize)  (add0204fa61599075851e093464c3420)

1 / 68      (Adware)
component_48.decrpt  (f9ac3d626d30a059090017cf90dcd94b)

1 / 68      (Adware)
whitesmoketranslator_12530.exe  (c79d6012e5828f8b721e5ceb6e0f9a7d)

28 / 68    (Adware)
setup__120.exe (Installer by Amonetize)  (4cb017c8c0ea6b675b10e88cdaeec91d)

28 / 68    (Adware)
setup__120.exe (Installer by Amonetize)  (2a513fccbc061e38990552aae34a863d)

1 / 68      (Adware)

1 / 68      (Adware)
setup__423.exe (Installer by Amonetize ltd)  (4a5eeb508e2bf43990b883c4de2fb3d5)

1 / 68      (Adware)
Setup.exe (WhiteSmoke Installer by WhiteSmoke)  (e8fbe1fc96b8ea8fdc84cfb485c14787)

1 / 68      (Adware)
setup__1811.exe (Installer by Amonetize)  (16983ba01c56a46111e7269accab2e53)

15 / 68    (Adware)

16 / 68    (Adware)

28 / 68    (Adware)
setup__120.exe (Installer by Amonetize ltd)  (2bf9bcdaa78ac2ca538738e572bddccc)

13 / 68    (Adware)

1 / 68      (Adware)
component_85.decrpt  (2692d291f086cfb7f9110a16667bc5ce)

2 / 68      (Adware)

7 / 68      (Adware)

20 / 68    (Adware)

13 / 68    (Adware)

12 / 68    (Adware)
grammar-checker.exe (WhiteSmoke Installer by WhiteSmoke)  (8f56fc2c8d13a6ed9fb2da752da05be2)

28 / 68    (Adware)

 
Latest 30 of 94 files

Downloads URLs for files signed by WhiteSmoke Inc.

6 / 68      (Adware)
http://get.whitesmoke.com/WhiteSmoke_Enrichment_Full.exe  (1ee1efec5a98854925a04682ce1b4025)

The following websites host and distribute files published by WhiteSmoke Inc.

The certificates below are also signed by WhiteSmoke Inc.

1464EFB2CC87AF9A3F855E683C12294D  (Aug 04, 2015 to Sep 03, 2017)

55439B87CB55E81147C072F06F4F77EF  (Jul 06, 2013 to Aug 05, 2015)

4261300AF5254B751250B0CDBDA6CE61  (Jun 09, 2008 to Jul 08, 2011)

6909B96020B7E23C83DA2D03280AA61E  (May 17, 2007 to Jun 17, 2008)

The following publishers (by Authenticode signature organization name) are related.

* Note, the details and description above are based on the code signing digital signature issued to WhiteSmoke Inc by VeriSign, Inc. on June 28, 2011 with the serial number '64048d72f9ffef12a43fc4f4cea580e3'.