home

similarwebbundledl.exe

SimilarWeb

SimilarWeb Ltd.

The application similarwebbundledl.exe by SimilarWeb has been detected as a potentially unwanted program by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from sd-cf.en.softonic.com.
Publisher:
SimilarGroup  (signed by SimilarWeb Ltd.)

Product:
SimilarWeb

Version:
0.0.0.1

MD5:
e2c4e64209e1dc62361b0f9d00f61436

SHA-1:
81ba90cf6b2ba5f8352827c6f07997c73374fa29

SHA-256:
1f481ee7392579c1e678916fc3d20e346d172252ae293b3dc5b46b80682c957f

Scanner detections:
7 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 11:39:08 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.1509
9.0.1.0359

herdProtect (fuzzy)
variant of similarbundlegenericdl.exe (PUP)
2014.1.2.11

Norman
Downloader
11.20131225

Reason Heuristics
PUP.SimilarWeb.S
14.2.22.22

Trend Micro House Call
TROJ_GEN.R0CBH07I613
7.2.359

Trend Micro
TROJ_GEN.R0CBC0OJF13
10.465.25

Vba32 AntiVirus
TrojanDownloader.Genome
3.12.24.3

File size:
72 KB (73,744 bytes)

Product version:
0.0.0.1

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\similarwebbundledl.exe

Digital Signature
Signed by:
SimilarWeb Ltd.

Authority:
VeriSign, Inc.

Valid from:
3/20/2012 4:00:00 AM

Valid to:
3/21/2013 3:59:59 AM

Subject:
CN=SimilarWeb Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SimilarWeb Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
437307139AB8798C2CF18A6B3A5CA054

File PE Metadata
Compilation timestamp:
12/6/2009 2:50:41 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:oLXB65939tY6HBg4sXJm4Romu/TPbKrCj/LnVzS8qcy4je:oLk395hYXJm45k7nhjy4je

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.1123

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file similarwebbundledl.exe has been seen being distributed by the following URL.

http://sd-cf.en.softonic.com/69654000/69654857/.../SimilarWebBundleDl.exe

Remove similarwebbundledl.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.