» TheAnswerFinder.exe
Overview
Analysis
File Details
Behaviors (1)
Network (1)

TheAnswerFinder.exe

TheAnswerFinder

Mime Ventures LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application TheAnswerFinder.exe by Mime Ventures has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 49249 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins.

File name:

TheAnswerFinder.exe

Publisher:

Mime Ventures (signed by Mime Ventures LLC)

Product:

TheAnswerFinder

Version:

1.0

MD5:

73bcc0215cc3969f36447afebdaf031a

SHA-1:

0a3e4686c8d44055adc830a045b1a3b06f2d3bfb

SHA-256:

88cf0b7e4f3513c31b194be18e81d53b67c822f72fbe93e52516d43c1b0484d0

Scanner detections:

12 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

2/9/2026 6:03:58 AM UTC (today)

Scan engine

Detection

Engine version

AegisLab AV Signature

AdWare.W32.InstallBrain

2.1.4+

AhnLab V3 Security

Adware/Win32.IBryte

2015.01.17

avast!

Win32:IBryte-JD [PUP]

2014.9-150120

AVG

Generic

2016.0.3223

Baidu Antivirus

Adware.MSIL.iBryte

4.0.3.15120

Dr.Web

Trojan.iBryte.78

9.0.1.020

ESET NOD32

MSIL/Adware.iBryte (variant)

9.11028

Malwarebytes

PUP.Optional.TheAnswerFinder.A

v2015.01.20.07

McAfee

Artemis!73BCC0215CC3

5600.6879

Norman

IBryte.AJQ

11.20150120

Reason Heuristics

PUP.Softpulse

15.1.21.15

Trend Micro House Call

Suspicious_GEN.F47V0116

7.2.20

File size:

1.7 MB (1,786,312 bytes)

Product version:

1.0

Original file name:

TheAnswerFinder.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\theanswerfinder\theanswerfinder.exe

Digital Signature

Signed by:

Mime Ventures LLC

Authority:

GlobalSign nv-sa

Valid from:

10/17/2014 12:39:32 PM

Valid to:

10/18/2015 12:39:32 PM

Subject:

E=admin@theanswerfinder.com, CN=Mime Ventures LLC, OU=TheAnswerFinder.com, O=Mime Ventures LLC, L=Los Angeles, S=California, C=US

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121EDDEAF81A380FF278B94B619A213DEEE

File PE Metadata

Compilation timestamp:

1/16/2015 1:49:24 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

49152:XVITv0hJ9IwUDKyLpNntVihqIPN27ORXIzawum9p:iYh8wUecTHihq2N27ORUPuup

Entry address:

0x1B167A

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.7038

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.7 MB (1,767,424 bytes)

Local Proxy Server

Proxy for:

Internet Settings

Local host address:

http://127.0.0.1:49249/

Local host port:

49249

Default credentials:

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP SSL):

Connects to webmail1.t-mobile.com (206.29.178.91:443)

Remove TheAnswerFinder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.