» TowerTilt.FirstRun.exe
Overview
Analysis
File Details
Programs (2)

TowerTilt.FirstRun.exe

FirstRun

TowerTilt

The Yontoo branded FirstRun executable is distributed as part of a Yontoo product bundle and is desigend to install components of this ad-supported (injection) program as well as 'call home' to inform the server that the extension was installed and may request additional instructions. The application TowerTilt.FirstRun.exe by TowerTilt has been detected as adware by 19 anti-malware scanners. Additionally, the file is typically installed by a number of programs including TowerTilt by Yontoo Technology, Inc. and Buzzdock by Alactro LLC, both potentially unwanted software. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

TowerTilt (signed and verified)

Product:

FirstRun

Version:

1.0.0.0

MD5:

85c452fee1596abab12fb9227f90cd95

SHA-1:

99574d2d7f3bf79bf6e6b2c0f03c92c22bc24d55

SHA-256:

209472aeead545cc3b3a0d8bf07032747bf8c88fec816dab6c31ab2a17986341

Scanner detections:

19 / 68

Status:

Adware

Explanation:

Part of the Yontoo ad injection web browser add-on.

Analysis date:

4/19/2024 9:37:40 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.CN

358

AhnLab V3 Security

Win-PUP/BrowseFox.Gen

2014.11.16

Avira AntiVirus

APPL/BrowseFox.Gen

7.11.160.62

AVG

Towit

2017.0.2836

Baidu Antivirus

Adware.MSIL.BrowseFox

4.0.3.16212

Bitdefender

Adware.SwiftBrowse.CN

1.0.20.215

Comodo Security

UnclassifiedMalware

18849

Emsisoft Anti-Malware

Adware.SwiftBrowse.CN

8.16.02.12.07

ESET NOD32

MSIL/BrowseFox.D potentially unwanted application

10.7.0.302.0

F-Secure

Adware.SwiftBrowse.CN

11.2016-12-02_6

G Data

Adware.SwiftBrowse.CN

16.2.24

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Kranet

14.0.0.673

Malwarebytes

PUP.Optional.Sambreel.A

v2016.02.12.07

McAfee

Artemis!86963DABDB5C

5600.6492

MicroWorld eScan

Adware.SwiftBrowse.CN

17.0.0.129

nProtect

Adware.SwiftBrowse.CN

14.11.14.01

Reason Heuristics

Adware.Yontoo.TowerTilt (M)

16.2.12.7

Trend Micro House Call

Suspicious_GEN.F47V0628

7.2.43

VIPRE Antivirus

Yontoo

31196

File size:

1.1 MB (1,123,616 bytes)

Product version:

1.0.0.0

Original file name:

TowerTilt.FirstRun.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\towertilt\towertilt.firstrun.exe

Digital Signature

Signed by:

TowerTilt

Authority:

VeriSign, Inc.

Valid from:

2/4/2014 7:00:00 AM

Valid to:

2/5/2015 6:59:59 AM

Subject:

CN=TowerTilt, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TowerTilt, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0DC21B60DDFB723E55B2F05376083F29

File PE Metadata

Compilation timestamp:

6/18/2014 6:11:41 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:cZSg8kNzSKg/4cmYeJ7IYA1fQ+YEUxDYDECIcZT666G4+:cZmPKgATJ7IYAh5jg2O66G4+

Entry address:

0x11205A

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.9243

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.1 MB (1,114,624 bytes)

The file TowerTilt.FirstRun.exe has been discovered within the following programs.

Buzzdock by Alactro LLC

This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.

www.buzzdock.com/faq-support

79% remove it

TowerTilt by Yontoo Technology, Inc.

TiltBorwser is a Yontoo/Sambreel advertising injection adware browser extension. From the EULA: "The Software is supported by various types of advertising, including, without limitation, windows pop messages, default browser popups.

towertilt.com/support

80% remove it

Remove TowerTilt.FirstRun.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.