» ZombieAlert.exe
Overview
Analysis
File Details
Programs (1)
Network (2)

ZombieAlert.exe

Zombie Alert

Creative Island Media, LLC

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser. Part of the Injekt brand of unwanted programs. The application ZombieAlert.exe by Creative Island Media has been detected as adware by 17 anti-malware scanners. This file is typically installed with the program Zombie Alert by Creative Island Media, LLC which is a potentially unwanted software program. While running, it connects to the Internet address update.betterxperience.com on port 80 using the HTTP protocol.

File name:

ZombieAlert.exe

Publisher:

Creative Island Media, LLC (signed and verified)

Product:

Zombie Alert

Version:

1.0.1.0

MD5:

72e3d1fbe1ababe9aab241ed924108b9

SHA-1:

c09f88c1b62685ba9202c65fd8756014db43a68f

SHA-256:

ddbd42a253d5633b6c3fb55d5ba11af62f7ed28ec4ea031a6676e16380d0a3ec

Scanner detections:

17 / 68

Status:

Adware

Explanation:

Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:

4/25/2024 6:46:22 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.SaMon

7.1.1

avast!

Win32:Adware-gen [Adw]

2014.9-160201

Comodo Security

ApplicUnwnt

18137

Dr.Web

Adware.Plugin.173

9.0.1.032

ESET NOD32

MSIL/Adware.PullUpdate (variant)

10.9639

Fortinet FortiGate

Adware/SaMon

2/1/2016

IKARUS anti.virus

not-a-virus:AdWare.Win32.SaMon

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11806

Kaspersky

not-a-virus:AdWare.Win32.SaMon

14.0.0.728

Malwarebytes

PUP.Optional.ZombieAlert.A

v2016.02.01.07

McAfee

Artemis!56D05C11EB74

5600.6503

Qihoo 360 Security

Win32/Trojan.Adware.fb2

1.0.0.1015

Reason Heuristics

PUP.Injekt.CreativeIslandMedia (M)

16.2.1.7

Sophos

Generic PUA AH

4.98

Trend Micro House Call

TROJ_GEN.F47V0402

7.2.32

Vba32 AntiVirus

AdWare.SaMon

3.12.26.0

VIPRE Antivirus

SearchDonkey

28094

File size:

41.9 KB (42,872 bytes)

Product version:

1.0.1.0

Original file name:

ZombieAlert.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\ProgramData\zombiealert\zombiealert.exe

Digital Signature

Signed by:

Creative Island Media, LLC

Authority:

VeriSign, Inc.

Valid from:

3/23/2014 8:00:00 PM

Valid to:

6/23/2015 7:59:59 PM

Subject:

CN="Creative Island Media, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Creative Island Media, LLC", L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0ED42A15C608C5CB28B1EF56CE392E5E

File PE Metadata

Compilation timestamp:

4/24/2014 5:47:11 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

768:DWvmF80denAu7jLcoNDYv1xm7tWOm5XsPN6qXxBStzYcHeGKqFuoWo5:qvmy0denAu7jLcoibKW95XsV6qXxBSMG

Entry address:

0x98FE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

5.9353

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

30.5 KB (31,232 bytes)

The file ZombieAlert.exe has been discovered within the following program.

Zombie Alert by Creative Island Media, LLC

This is ad-supported (adware) software, part of Injekt, that is very difficult to remove as the publisher will ignore the Windows Add/Remove feature and re-install it after the user reboot their PC.

www.injekt.com

88% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to update.betterxperience.com (54.218.62.24:80)

TCP (HTTP):

Connects to d.pullupdate.com (54.230.15.37:80)

Remove ZombieAlert.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.