updateplurpush.exe

PlurPush

Part of the Yontoo web browser plugin (delivers advertisements to the web browser in the form of injected banners, text-links, popups, etc.) the updater mechanism for PlurPush will automatically keep the extension patched by downloaded new functionality which is auto-enabled by default. The application updateplurpush.exe by PlurPush has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update PlurPush”. This file is typically installed with the program PlurPush by Yontoo Technology, Inc. which is a potentially unwanted software program.
Publisher:
PlurPush  (signed and verified)

Version:
1.0.5186.20128

MD5:
48f26a6df121c465109489482f0cb9d9

SHA-1:
8a05b0fae520bc843670db99c3624b5d4dfa54e2

SHA-256:
ee9d5bd7072f1cf6474313a0981ea0114a862b2919ba4c053d157d8c9be76948

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Part of the Yontoo adware web browser extension update process.

Analysis date:
8/8/2014 4:54:22 AM UTC  (25 days ago)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Yontoo.Service.O
14.8.8.0

File size:
340.8 KB (348,952 bytes)

Product version:
1.0.5186.20128

Original file name:
PlurPush.exe

File type:
Executable application (Win32 EXE)

Language:
Swedish (Sweden)

Common path:
C:\Program Files\plurpush\updateplurpush.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
9/19/2013 2:00:00 AM

Valid to:
9/20/2015 1:59:59 AM

Subject:
CN=PlurPush, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PlurPush, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
30ACE095C6EE9F3C39428EB86ECAFADF

File PE Metadata
Compilation timestamp:
3/14/2014 1:11:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:nPi5C4Eie1BYwX+41VWvfeVzN+PBNleyVsjZtwiANIvD9lRVvG3430cNbKw:nPi58eCud2b9lRVuNzw

Entry address:
0x54E4E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
332 KB (339,968 bytes)

Service
Display name:
Update PlurPush

Type:
Win32OwnProcess


The file updateplurpush.exe has been discovered within the following programs.

PlurPush  by Yontoo Technology, Inc.
This adware program injects advertisements with its affiliate ad providers in order to serve a number of ad types including banner, inline text links and popups.
plurpush.net/support
82% remove it
 
Powered by Should I Remove It?

5 / 68      (Adware)
plurpush_ob.exe  (5ea307c13114afa72f95b27d1b35d8c78bc4f5ad)

7 / 68      (Adware)
setup.exe  (fd0ce935f8a2905b56a49617050c8f7d3abe3946)

30 / 68    (Adware)
plurpushbho.dll  (786649ff051c9d151e3568c23002ceeeb08801ad)

1 / 68      (Adware)
utilplurpush.exe  (94fa6556a3095a890f40b1c5b9ba3a3234e53816)

1 / 68      (Adware)
PlurPush.FFUpdate.dll  (294a3137674e3ab6b9b61726d3677370846c8361)

1 / 68      (Adware)
PlurPush.GCUpdate.dll  (c8467272d7b9d62303085e8053ded3cd7b61bd22)

1 / 68      (Adware)
PlurPush.IEUpdate.dll  (5fab4a00bfefd17d9e5326cf50302944e168b798)

1 / 68      (Adware)
plurpush.16.dll  (4633afefd190d92631a7eb57a7c4755529249cdf)

1 / 68      (Adware)
PlurPush.BrowserFilter.dll  (11f2f102d2c2213509b522d6782c4cf40c78b777)

7 / 68      (Adware)
PlurPush.FirstRun.exe  (2cb8d92f331e4e41ae78b75e0f4c4e10c8f1dbda)

2 / 68      (Adware)
wstlibg64.sys  (fa14aa320b50952de7befd782f22300523e5815a)

2 / 68      (Adware)
tstlibg.sys  (4fe959e1530e53edfe9e2492acd75ec1cd51c8b0)

7 / 68      (Adware)
filterapp_c64.exe  (96ef9306eb8f1af94114ee1f3d268817dfacc751)

3 / 68      (Adware)
plurpushba.dll  (c58ff972372f05611172379c4b5b3823cc5fafe8)

Detection Incidence by Country