» TheAnswerFinder.exe
Overview
Analysis
File Details
Behaviors (1)

TheAnswerFinder.exe

TheAnswerFinder

Mime Ventures LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application TheAnswerFinder.exe by Mime Ventures has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This executable runs as a local area network (LAN) Internet proxy server listening on port 60475 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins.

File name:

TheAnswerFinder.exe

Publisher:

Mime Ventures (signed by Mime Ventures LLC)

Product:

TheAnswerFinder

Version:

1.0

MD5:

2b17495946be52c1545d8944fc667a12

SHA-1:

f824b673da1d93bb9cf5cae26a809968dc68e028

SHA-256:

d190b8d5ce4a1ec147ea48707d00450140cdb6340932ffe1aa95228be80f4f41

Scanner detections:

33 / 68

Status:

Adware

Explanation:

Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/19/2024 7:47:34 AM UTC (today)

Scan engine

Detection

Engine version

AegisLab AV Signature

AdWare.W32.InstallBrain

2.1.4+

AhnLab V3 Security

Adware/Win32.IBryte

2015.01.25

Avira AntiVirus

Adware/iBryte.plsaza

7.11.204.224

avast!

Win32:IBryte-GY [PUP]

2014.9-150328

AVG

Generic

2016.0.3156

Baidu Antivirus

Adware.Win32.TheAnswerFinder

4.0.3.15328

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

ApplicUnwnt

20265

Dr.Web

Trojan.iBryte.493

9.0.1.05190

ESET NOD32

MSIL/Adware.iBryte.P application

7.0.302.0

Fortinet FortiGate

Adware/IBryte

3/28/2015

F-Secure

Riskware.Gen:Variant.Application.Bundler

11.2015-28-03_7

IKARUS anti.virus

AdWare.AgentCV

t3scan.1.8.6.0

Malwarebytes

PUP.Optional.TheAnswerFinder.A

v2015.03.28.04

McAfee

Artemis!9AB594C3DE9A

5600.6812

Norman

IBryte.AJQ

11.20150328

Qihoo 360 Security

HEUR/QVM03.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Bundler.Softpulse

15.3.28.16

Trend Micro House Call

Suspicious_GEN.F47V1120

7.2.87

Trend Micro

TROJ_GEN.R02KC0OAN15

10.465.28

VIPRE Antivirus

iBryte

36934

File size:

1.7 MB (1,787,096 bytes)

Product version:

1.0

Original file name:

TheAnswerFinder.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\theanswerfinder\theanswerfinder.exe

Digital Signature

Signed by:

Mime Ventures LLC

Authority:

GlobalSign nv-sa

Valid from:

10/17/2014 10:39:32 AM

Valid to:

10/18/2015 10:39:32 AM

Subject:

E=admin@theanswerfinder.com, CN=Mime Ventures LLC, OU=TheAnswerFinder.com, O=Mime Ventures LLC, L=Los Angeles, S=California, C=US

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121EDDEAF81A380FF278B94B619A213DEEE

File PE Metadata

Compilation timestamp:

3/23/2015 7:31:22 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

49152:MZo9Lfg0iT4Kk8fouZVT45Lsvf4rxMIMvSL:F9LfgT0Hr+T45LsrV6L

Entry address:

0x1B1BCA

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, 10, 24, 00, 80, 10, 00, 00, 00, 8A, 24, 00, 80, 18, 00, 00, 00, F2, 27, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 02, 00, 00, 00, 60, 00, 00, 80, 03, 00... 
[+]

Entropy:

7.7052

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.7 MB (1,768,448 bytes)

Local Proxy Server

Proxy for:

Internet Settings

Local host address:

http://127.0.0.1:60475/

Local host port:

60475

Default credentials:

Remove TheAnswerFinder.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.