updateplurpush.exe

PlurPush

Part of the Yontoo web browser plugin (delivers advertisements to the web browser in the form of injected banners, text-links, popups, etc.) the updater mechanism for PlurPush will automatically keep the extension patched by downloaded new functionality which is auto-enabled by default. The application updateplurpush.exe by PlurPush has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update PlurPush”. This file is typically installed with the program PlurPush by Yontoo Technology, Inc. which is a potentially unwanted software program.
Publisher:
PlurPush  (signed and verified)

Version:
1.0.5192.28950

MD5:
2c0208ba96ced7bef99ab17c3dcd4641

SHA-1:
9e0323764ad81153fcb1698df60b48b38092de8d

SHA-256:
7fd305a2c8d5e983ed0f1893eee0e21d2747eee8dc40b71761ccf13d5392e64c

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Part of the Yontoo adware web browser extension update process.

Analysis date:
3/21/2014 8:32:01 PM UTC  (four months ago)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Yontoo.PlurPush.O
14.3.21.16

File size:
340.3 KB (348,440 bytes)

Product version:
1.0.5192.28950

Original file name:
PlurPush.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\plurpush\updateplurpush.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
9/18/2013 5:00:00 PM

Valid to:
9/19/2015 4:59:59 PM

Subject:
CN=PlurPush, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PlurPush, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
30ACE095C6EE9F3C39428EB86ECAFADF

File PE Metadata
Compilation timestamp:
3/20/2014 10:05:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:KUl5C4dnPeTYT4R41DWvaeVzN+KJ+x6VulSRG6sUgFH4NXG34xbccCbbWZou:KUl5Utd4mgFH4NWfTWZf

Entry address:
0x54D46

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.0703

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
331.5 KB (339,456 bytes)

Service
Display name:
Update PlurPush

Type:
Win32OwnProcess


The file updateplurpush.exe has been discovered within the following programs.

PlurPush  by Yontoo Technology, Inc.
This adware program injects advertisements with its affiliate ad providers in order to serve a number of ad types including banner, inline text links and popups.
plurpush.net/support
82% remove it
 
Powered by Should I Remove It?

5 / 68      (Adware)
plurpush_ob.exe  (5ea307c13114afa72f95b27d1b35d8c78bc4f5ad)

7 / 68      (Adware)
setup.exe  (fd0ce935f8a2905b56a49617050c8f7d3abe3946)

10 / 68    (Adware)
plurpushbho.dll  (786649ff051c9d151e3568c23002ceeeb08801ad)

1 / 68      (Adware)
utilplurpush.exe  (94fa6556a3095a890f40b1c5b9ba3a3234e53816)

1 / 68      (Adware)
PlurPush.FFUpdate.dll  (294a3137674e3ab6b9b61726d3677370846c8361)

1 / 68      (Adware)
PlurPush.GCUpdate.dll  (c8467272d7b9d62303085e8053ded3cd7b61bd22)

1 / 68      (Adware)
PlurPush.IEUpdate.dll  (5fab4a00bfefd17d9e5326cf50302944e168b798)

1 / 68      (Adware)
plurpush.16.dll  (4633afefd190d92631a7eb57a7c4755529249cdf)

1 / 68      (Adware)
PlurPush.BrowserFilter.dll  (11f2f102d2c2213509b522d6782c4cf40c78b777)

1 / 68      (Adware)
PlurPush.FirstRun.exe  (2cb8d92f331e4e41ae78b75e0f4c4e10c8f1dbda)

2 / 68      (Adware)
wstlibg64.sys  (fa14aa320b50952de7befd782f22300523e5815a)

2 / 68      (Adware)
tstlibg.sys  (4fe959e1530e53edfe9e2492acd75ec1cd51c8b0)

7 / 68      (Adware)
filterapp_c64.exe  (96ef9306eb8f1af94114ee1f3d268817dfacc751)

3 / 68      (Adware)
plurpushba.dll  (c58ff972372f05611172379c4b5b3823cc5fafe8)

Detection Incidence by Country