Zebar.FirstRun.exe

FirstRun

Zebar

The Yontoo branded FirstRun executable is distributed as part of a Yontoo product bundle and is desigend to install components of this ad-supported (injection) program as well as 'call home' to inform the server that the extension was installed and may request additional instructions. The application Zebar.FirstRun.exe by Zebar has been detected as adware by 6 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Remove Zebar.FirstRun.exe - Powered by Reason Core Security
Publisher:
Zebar  (signed and verified)

Product:
FirstRun

Version:
1.0.0.0

MD5:
af9f945a2826337da3796c84600daf65

SHA-1:
556ca8dbaa4c032e581ddf2421d78f1fac7f1449

SHA-256:
499da1676033a74242be635d7f46ae94d0cbf356387347604a2dfc7b295d14b6

Scanner detections:
6 / 68

Status:
Adware

Explanation:
Part of the Yontoo ad injection web browser add-on.

Analysis date:
12/3/2016 4:57:04 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/BrowseFox.Gen
7.11.154.60

AVG
Zebrar
2015.0.3447

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.14610

ESET NOD32
MSIL/BrowseFox.G potentially unwanted application
7.0.302.0

Malwarebytes
v2014.06.10.02

Reason Heuristics
Adware.Yontoo.Zebar.N
14.6.10.14

Remove Zebar.FirstRun.exe - Powered by Reason Core Security
File size:
1.1 MB (1,123,096 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2014

Original file name:
Zebar.FirstRun.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\zebar\zebar.firstrun.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
3/9/2014 7:00:00 PM

Valid to:
3/10/2015 6:59:59 PM

Subject:
CN=Zebar, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Zebar, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
443A7E0E2025885A74F146162C4BEE38

File PE Metadata
Compilation timestamp:
6/10/2014 1:02:36 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:RQETrMBBM2CFVlQVSzn2sv2j/0pnRD5qt0M3BBAzrqzS:RQwAB22aian4MnpC0M3BBurX

Entry address:
0x111F96

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
1.1 MB (1,114,112 bytes)

Remove Zebar.FirstRun.exe - Powered by Reason Core Security