utilplurpush.exe

PlurPush

The application utilplurpush.exe by PlurPush has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update PlurPush”. This file is typically installed with the program PlurPush 1.0.0 by PlurPush which is a potentially unwanted software program. It is part of the Yontoo branded browser-extension.
Publisher:
PlurPush  (signed and verified)

Version:
1.0.5123.9557

MD5:
bcfbbf2b8c87acb2c4771d52370e9349

SHA-1:
94fa6556a3095a890f40b1c5b9ba3a3234e53816

SHA-256:
9360274bdeeb0c0324d2b89170b99554ed3dc68d3ac0da08b9f2c6f8e4c06519

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Belongs to the Sambreel/Yontoo progam that inserts various forms of advertising in the user's web browser, installed with minimal or no user consent.

Analysis date:
8/8/2014 4:54:23 AM UTC  (two months ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Service.PlurPush.M
14.8.8.0

File size:
94.8 KB (97,048 bytes)

Product version:
1.0.5123.9557

Original file name:
PlurPush.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\plurpush\bin\utilplurpush.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
9/18/2013 7:00:00 PM

Valid to:
9/19/2015 6:59:59 PM

Subject:
CN=PlurPush, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PlurPush, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
30ACE095C6EE9F3C39428EB86ECAFADF

File PE Metadata
Compilation timestamp:
1/9/2014 11:18:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:KbjWoXnNM5uBmyKR9xs+ydKoy5i+ctONOsURhAWHtv3J8BrQbbVPHmKho5yz:Kbj5na5EW9xs+8MinOsBnAM3J8BrgbJ5

Entry address:
0x17776

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1776

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
86 KB (88,064 bytes)

Service
Display name:
Update PlurPush

Type:
Win32OwnProcess


The file utilplurpush.exe has been discovered within the following program.

PlurPush 1.0.0  by PlurPush
This toolbar/web browser extension is typically installed as an optional offer, users generally have this bundled with 3rd party software.
plurpush.net/support
62% remove it
 
Powered by Should I Remove It?

1 / 68      (Adware)
updateplurpush.exe (by PlurPush)  (aeb15206b59a331040bcec7fac2243a061267acc)

5 / 68      (Adware)
plurpush_ob.exe  (5ea307c13114afa72f95b27d1b35d8c78bc4f5ad)

7 / 68      (Adware)
setup.exe  (fd0ce935f8a2905b56a49617050c8f7d3abe3946)

30 / 68    (Adware)
plurpushbho.dll  (786649ff051c9d151e3568c23002ceeeb08801ad)

1 / 68      (Adware)
PlurPush.FFUpdate.dll  (294a3137674e3ab6b9b61726d3677370846c8361)

1 / 68      (Adware)
PlurPush.GCUpdate.dll  (c8467272d7b9d62303085e8053ded3cd7b61bd22)

1 / 68      (Adware)
PlurPush.IEUpdate.dll  (5fab4a00bfefd17d9e5326cf50302944e168b798)

1 / 68      (Adware)
plurpush.16.dll  (4633afefd190d92631a7eb57a7c4755529249cdf)

1 / 68      (Adware)
PlurPush.BrowserFilter.dll  (11f2f102d2c2213509b522d6782c4cf40c78b777)

7 / 68      (Adware)
PlurPush.FirstRun.exe  (2cb8d92f331e4e41ae78b75e0f4c4e10c8f1dbda)

2 / 68      (Adware)
wstlibg64.sys  (fa14aa320b50952de7befd782f22300523e5815a)

2 / 68      (Adware)
tstlibg.sys  (4fe959e1530e53edfe9e2492acd75ec1cd51c8b0)

7 / 68      (Adware)
filterapp_c64.exe  (96ef9306eb8f1af94114ee1f3d268817dfacc751)

Detection Incidence by Country