» utility.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Downloads (2)
Network (27)

utility.exe

Oral Teams (Extreme White Limited)

The application utility.exe by Oral Teams (Extreme White Limited) has been detected as a potentially unwanted program by 8 anti-malware scanners. This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler named MyBrowser. This file is typically installed with the program MyBrowser by The MyBrowser Authors which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

utility.exe

Publisher:

Oral Teams (Extreme White Limited) (signed and verified)

Version:

106.0.0.0

MD5:

e67f1b7e577ce16d1edbce5686c8a849

SHA-1:

60ed00a87e168ecdc7900f9fe2822d0535b78336

SHA-256:

2b01e20a1e732dc67421736a68a9b0caaf3582d01675ddea7dc6a38023e44135

Scanner detections:

8 / 68

Status:

Potentially unwanted

Explanation:

May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:

5/8/2024 12:48:45 AM UTC (today)

Scan engine

Detection

Engine version

Emsisoft Anti-Malware

Gen:Variant.Zusy.157780

8.15.09.08.02

ESET NOD32

Win32/Toolbar.CrossRider.CZ potentially unwanted (variant)

9.12189

F-Secure

Gen:Variant.Zusy.157780

11.2015-08-09_3

Kaspersky

not-a-virus:WebToolbar.Win32.CrossRider

14.0.0.1459

Malwarebytes

PUP.Optional.CrossRider

v2015.09.08.02

Reason Heuristics

PUP.ExtremeWhite.Bundler.Meta (M)

15.9.4.1

Sophos

AppRider (PUA)

4.98

VIPRE Antivirus

Crossrider

43380

File size:

1.9 MB (1,998,408 bytes)

Product version:

106.0.0.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\mybrowser\mybrowser\application\utility.exe

Digital Signature

Signed by:

Oral Teams (Extreme White Limited)

Authority:

COMODO CA Limited

Valid from:

4/14/2015 9:00:00 AM

Valid to:

4/14/2016 8:59:00 AM

Subject:

CN=Oral Teams (Extreme White Limited), O=Oral Teams (Extreme White Limited), STREET=Tassou Papadopulu 6 (flat/office 22), L=Nicosia, S=Agios Dometios, PostalCode=2373, C=CY

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00B8F2E0D231E7596923282FB14A063652

File PE Metadata

Compilation timestamp:

9/3/2015 10:33:26 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

49152:/lRNEeLgaFAs2ViZelIOoD4KT5pSrLMfvBly4SJ6KiO3cj+oi:d3ETkAsKiQlIOrn

Entry address:

0x132FFE

Entry point:

E8, 58, 11, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 24, 6E, 5D, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 48, AE, 5C, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, 24, 6E, 5D, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01... 
[+]

Code size:

1.4 MB (1,447,424 bytes)

Scheduled Task

Task name:

MyBrowser

The file utility.exe has been discovered within the following program.

MyBrowser by The MyBrowser Authors

About 57% of users remove it

The file utility.exe has been seen being distributed by the following 2 URLs.

http://dl.cloudprogem.com/69/all/cp/.../setup.exe

http://dt3j8jg8ei6zr.cloudfront.net/mirror/seekmx/.../setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ec2-107-22-247-81.compute-1.amazonaws.com (107.22.247.81:80)

TCP (HTTP):

Connects to tlb.hwcdn.net (69.16.175.10:80)

TCP (HTTP):

Connects to s3-website-us-east-1.amazonaws.com (54.231.114.193:80)

TCP (HTTP):

Connects to ec2-54-235-102-46.compute-1.amazonaws.com (54.235.102.46:80)

TCP (HTTP):

Connects to hwcdn.net (69.16.175.42:80)

TCP (HTTP):

Connects to ec2-23-23-221-88.compute-1.amazonaws.com (23.23.221.88:80)

TCP (HTTP):

Connects to ec2-23-23-100-24.compute-1.amazonaws.com (23.23.100.24:80)

TCP (HTTP):

Connects to ec2-54-243-91-79.compute-1.amazonaws.com (54.243.91.79:80)

TCP (HTTP):

Connects to ec2-54-235-218-133.compute-1.amazonaws.com (54.235.218.133:80)

TCP (HTTP):

Connects to ec2-54-235-183-213.compute-1.amazonaws.com (54.235.183.213:80)

TCP (HTTP):

Connects to ec2-50-17-253-207.compute-1.amazonaws.com (50.17.253.207:80)

TCP (HTTP):

Connects to ec2-23-23-98-183.compute-1.amazonaws.com (23.23.98.183:80)

TCP (HTTP):

Connects to ec2-107-22-213-25.compute-1.amazonaws.com (107.22.213.25:80)

Remove utility.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.