» updateresultsbay.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

updateresultsbay.exe

ResultsBay

Part of the Yontoo web browser plugin (delivers advertisements to the web browser in the form of injected banners, text-links, popups, etc.) the updater mechanism for ResultsBay will automatically keep the extension patched by downloaded new functionality which is auto-enabled by default. The application updateresultsbay.exe by ResultsBay has been detected as adware by 12 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “Update ResultsBay”. This file is typically installed with the program ResultsBay by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

ResultsBay (signed and verified)

Version:

1.0.5343.17159

MD5:

43162962f5fcf75a492f8b346ffaac0c

SHA-1:

929defeabb84fafbab6674c68329c382cc7a3d13

SHA-256:

783284d38920603eed83ba08c58c3702f2d80764e5c3069da2497427128209db

Scanner detections:

12 / 68

Status:

Adware

Explanation:

Part of the Yontoo adware web browser extension update process.

Analysis date:

4/25/2024 2:34:54 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2015.0.3374

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.14822

ESET NOD32

Win32/BrowseFox (variant)

8.10287

IKARUS anti.virus

PUA.BrowseFox

t3scan.1.7.5.0

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Kranet

14.0.0.3366

Malwarebytes

PUP.Optional.ResultsBay.A

v2014.08.22.06

McAfee

Artemis!43162962F5FC

5600.7030

nProtect

Trojan-Clicker/W32.Agent.323360.B

14.08.19.01

Panda Antivirus

Trj/Chgt.D

14.08.22.06

Qihoo 360 Security

Win32/Virus.Adware.e4c

1.0.0.1015

Reason Heuristics

Adware.Yontoo.ResultsBay.Q

14.8.22.18

VIPRE Antivirus

Yontoo

32388

File size:

315.8 KB (323,360 bytes)

Product version:

1.0.5343.17159

Original file name:

ResultsBay.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\resultsbay\updateresultsbay.exe

Digital Signature

Signed by:

ResultsBay

Authority:

VeriSign, Inc.

Valid from:

1/9/2014 12:00:00 AM

Valid to:

1/9/2015 11:59:59 PM

Subject:

CN=ResultsBay, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ResultsBay, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

417BA0831CCEDA70AD676F5D148B949A

File PE Metadata

Compilation timestamp:

8/18/2014 11:32:13 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

6144:/w1fAzddLsy2j9V27hMjd7Q/+9OeULPk0+S1Khy5uiwfzpwwBXbfUTefg:/w1fMx2+LKmwjMJ

Entry address:

0x4EBBE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, E0, 02, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 38, 00, 00, 80, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.0902

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

307 KB (314,368 bytes)

Service

Display name:

Update ResultsBay

Type:

Win32OwnProcess

The file updateresultsbay.exe has been discovered within the following programs.

Buzzdock by Alactro LLC

This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.

www.buzzdock.com/faq-support

79% remove it

ResultsBay by Yontoo Technology, Inc.

This adware software (a branded version of the morphing Yontoo adware browser addon) injects itself into the user's web browser (IE, Chrome and Firefox) and will display out-of context advertising on web sites that are not associated with Yontoo or its affiliate partners.

resultsbay.com/support

84% remove it

Remove updateresultsbay.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.