tb_WeLoveFilms.exe

1.3.8.7.140323.02

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application tb_WeLoveFilms.exe by ClientConnect has been detected as adware by 7 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from welovefilms.ourtoolbar.com and multiple other hosts. While running, it connects to the Internet address cms.dmccint.com on port 80 using the HTTP protocol.
Publisher:
ClientConnect LTD  (signed and verified)

Product:
1.3.8.7.140323.02

Description:
Setup.exe

Version:
1.3.8.7

MD5:
2ec6e20362f4d0c505f02cba49745471

SHA-1:
ad41c5d349781387f2b6fea4c8ef9e7d54e325f9

SHA-256:
793218abb48cb461fea0e6fed8cd4918ab0a3782bba8a4b4a04dc0cf9c604713

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
12/13/2018 5:34:13 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Conduit
7.1.1

AVG
MalSign.Generic
2015.0.3508

ESET NOD32
Win32/Toolbar.Conduit.AB (variant)
8.9629

Malwarebytes
PUP.Optional.Conduit.A
v2014.04.11.02

Reason Heuristics
PUP.Installer.ClientConnect.O
14.4.11.2

Trend Micro House Call
TROJ_GEN.F47V0327
7.2.101

VIPRE Antivirus
Trojan.Win32.Generic
27976

File size:
210 KB (215,064 bytes)

Product version:
1.3.8.7

Copyright:
© 2014 ClientConnect Ltd.

Original file name:
tb_WeLoveFilms.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\tb_welovefilms.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
2/3/2014 7:00:00 PM

Valid to:
2/5/2016 6:59:59 PM

Subject:
CN=ClientConnect LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=DM3, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
72ACCA392AFB8F2E42D5D3C0C97523F2

File PE Metadata
Compilation timestamp:
6/9/2012 9:19:49 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:8z+92mhAMJ/cPl3iwt/Lxv51iQd8VfKKr6h7O6OAg/BA:8K2mhAMJ/cPl79vDlGVSK8y9JA

Entry address:
0xAC87

Entry point:
E8, E3, FE, FF, FF, 33, C0, 50, 50, 50, 50, E8, 9F, 30, 00, 00, C3, 56, 57, 8B, 7C, 24, 0C, 8B, F1, 8B, CF, 89, 3E, E8, 8F, AB, FF, FF, 89, 46, 08, 89, 56, 0C, 8B, 87, 24, 0C, 00, 00, 89, 46, 10, 5F, 8B, C6, 5E, C2, 04, 00, 8B, C1, 8B, 08, 8B, 50, 10, 3B, 91, 24, 0C, 00, 00, 75, 0D, 6A, 00, FF, 70, 0C, FF, 70, 08, E8, 0E, B1, FF, FF, C3, 56, 8B, F1, 8B, 06, 85, C0, 74, 07, 50, FF, 15, C4, 40, 41, 00, 83, 26, 00, 83, 66, 08, 00, 83, 66, 0C, 00, 5E, C3, 56, 8B, F1, 80, 7E, 04, 00, 75, 34, 68, F4, 44, 41, 00...
 
[+]

Entropy:
7.5254

Code size:
73 KB (74,752 bytes)

The file tb_WeLoveFilms.exe has been seen being distributed by the following 3 URLs.

http://welovefilms.ourtoolbar.com/.../?sourceid=1

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to cms.dmccint.com  (23.67.242.80:80)

 
http://cms.dmccint.com/DynamicOffer/3804566/3825689/?mainofferId=3801132&CurrentStep=2&TotalSteps=4&DownloadBrowser=IE&CType=-1&UserMode=-1&DMVersion=1.3.8.82.3824555.01&Language=US-EN

Remove tb_WeLoveFilms.exe - Powered by Reason Core Security