tb_OTR1.exe

1.3.9.0.140504.01

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application tb_OTR1.exe by ClientConnect has been detected as adware by 19 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. While running, it connects to the Internet address cms.dmccint.com on port 80 using the HTTP protocol.
Remove tb_OTR1.exe - Powered by Reason Core Security
Publisher:
ClientConnect LTD  (signed and verified)

Product:
1.3.9.0.140504.01

Description:
Setup.exe

Version:
1.3.9.0

MD5:
c84de1c936cd562cd0dba9f492616431

SHA-1:
93fd063051407ab30b761596224197fa4b5dfceb

SHA-256:
794d6c7f6f03cb2960ca4827da7e00c31a09e1a77480b1410ef9ca668aadc84b

Scanner detections:
19 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
12/10/2016 11:53:48 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Conduit
7.1.1

AVG
Generic
2015.0.3447

Dr.Web
Adware.Conduit.96
9.0.1.0161

ESET NOD32
Win32/Toolbar.Conduit.AB (variant)
8.9808

Malwarebytes
PUP.Optional.Conduit.A
v2014.06.10.04

McAfee
Artemis!C84DE1C936CD
5600.7103

McAfee Web Gateway
Artemis!C84DE1C936CD
7.7103

Norman
Conduit.YH
11.20140610

Reason Heuristics
PUP.Installer.ClientConnect.H
14.6.10.16

Trend Micro House Call
TROJ_GEN.F47V0514
7.2.161

VIPRE Antivirus
Conduit
29266

Remove tb_OTR1.exe - Powered by Reason Core Security
File size:
207.3 KB (212,224 bytes)

Product version:
1.3.9.0

Copyright:
© 2014 ClientConnect Ltd.

Original file name:
tb_OTR1.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\tb_otr1.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
2/4/2014 1:00:00 AM

Valid to:
2/6/2016 12:59:59 AM

Subject:
CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=DM3, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
72ACCA392AFB8F2E42D5D3C0C97523F2

File PE Metadata
Compilation timestamp:
6/9/2012 3:19:49 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:Hz+92mhAMJ/cPl3iwIgozlx/LVXHSPF0Mffa:HK2mhAMJ/cPle57VXD

Entry address:
0xAC87

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 9F, 30, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 8F, AB, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 24, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 24, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 0E, B1, FF, FF, C3, 56, 8B, F1, 8B, 06, 85, C0, 74, 07, 50, FF, 15, C4, 40, 41, 00, 83, 26, 00, 83, 66, 08, 00, 83, 66, 0C, 00, 5E, C3, 56, 8B, F1, 80, 7E, 04, 00, 75, 34, 68, F4, 44, 41, 00...
 
[+]

Code size:
73 KB (74,752 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to cms.dmccint.com  (23.67.242.80:80)

 
http://cms.dmccint.com/DynamicOffer/6382030/6403153/?mainofferId=6378596&CurrentStep=2&TotalSteps=4&DownloadBrowser=IE&CType=-1&UserMode=-1&DMVersion=1.3.4.40.6402019.01&Language=US-EN

Remove tb_OTR1.exe - Powered by Reason Core Security