home

UpdateManager.exe

Update Manager

APN LLC

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application UpdateManager.exe by APN has been detected as a potentially unwanted program by 2 anti-malware scanners. While running, it connects to the Internet address www.search.ask.com on port 80 using the HTTP protocol.
Publisher:
APN LLC.  (signed by APN LLC)

Product:
Update Manager

Version:
21.25.0.8489

MD5:
d9fb00fe7228ce14b36fb794ff47617c

SHA-1:
16c0cff01f469ba79f8d79e9b96944adff8eadc1

SHA-256:
5757425667902c4b1d63ac55109aac95eaca6ea3f655cf2b29ab81bfc30dd59c

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
5/3/2024 8:40:17 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Ask (M)
17.3.16.2

File size:
105.6 KB (108,104 bytes)

Product version:
21.25.0.8489

Copyright:
© 2017 APN, LLC. All Rights Reserved.

Original file name:
UpdateManager.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\askpartnernetwork\toolbar\updatemanager.exe

Digital Signature
Signed by:
APN LLC

Authority:
Symantec Corporation

Valid from:
12/23/2016 8:00:00 AM

Valid to:
5/31/2018 7:59:59 AM

Subject:
CN=APN LLC, O=APN LLC, L=Oakland, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
643E1CE1B238C7969ABFC62773F3038C

File PE Metadata
Compilation timestamp:
2/22/2017 9:31:09 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
10.0

Entry address:
0x4FD6

Entry point:
E8, 04, 4B, 00, 00, E9, 95, FE, FF, FF, CC, CC, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, A8, 93, 41, 00, 89, 0D, A4, 93, 41, 00, 89, 15, A0, 93, 41, 00, 89, 1D, 9C, 93, 41, 00, 89, 35, 98, 93, 41, 00, 89, 3D, 94, 93, 41, 00, 66, 8C, 15, C0, 93, 41, 00, 66, 8C, 0D, B4, 93, 41, 00, 66, 8C, 1D, 90, 93, 41, 00, 66, 8C, 05, 8C, 93, 41, 00, 66, 8C, 25, 88, 93, 41, 00, 66, 8C, 2D, 84, 93, 41, 00, 9C, 8F, 05, B8, 93, 41, 00, 8B, 45, 00, A3, AC, 93, 41, 00, 8B, 45, 04, A3, B0, 93, 41, 00, 8D, 45, 08, A3, BC...
 
[+]

Entropy:
6.3892

Code size:
69 KB (70,656 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.search-results.com  (66.235.120.111:80)

TCP (HTTP):
Connects to www.search.ask.com  (23.76.222.3:80)

TCP (HTTP):
Connects to websearch.search-results.com  (199.36.100.106:80)

 
http://websearch.search-results.com/redirect?client=ff&src=kw&tb=GET-SRS&o=634364667&locale=us_ZZ&apn_uid=1903109703&apn_ptnrs=2R&apn_sauid=1268739802&apn_dtid=get001YYPT&q=

TCP (HTTP):
Connects to ss.websearch.ask.com  (174.129.25.170:80)

Remove UpdateManager.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.