Updater.exe

Updater

Escolade Solutions LTD.

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application Updater.exe by Escolade Solutions has been detected as adware by 7 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler named Escolade triggered daily at a specified time. This file is typically installed with the program iPumper Installer by Escolade Solutions LTD which is a potentially unwanted software program. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Escolade Solutions LTD.  (signed and verified)

Product:
Updater

Version:
1.0.0.0

MD5:
82d800d6e17d73b929995f700a3a9e55

SHA-1:
8ef3fca463eef72fadf34215e66f61e530df5504

SHA-256:
80f3612298d9d2203fc3ea5db17a37ec8c5347f5fe67c61363fe9ca3990dcd4f

Scanner detections:
7 / 68

Status:
Adware

Analysis date:
4/26/2024 8:44:32 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-BEK [PUP]
2014.9-140809

AVG
AdInstaller.U
2015.0.3388

Bkav FE
W32.Clodacf.Trojan
1.3.0.4959

Panda Antivirus
PUP/iPumper
14.08.09.07

Reason Heuristics
PUP.EscoladeSolutions.H
14.8.9.7

Sophos
iPumper Bundle
4.98

VIPRE Antivirus
iPumper
28732

File size:
13.9 KB (14,208 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
Updater.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\roaming\ipumper\updater.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
9/25/2012 3:00:00 AM

Valid to:
9/26/2013 2:59:59 AM

Subject:
CN=Escolade Solutions LTD., O=Escolade Solutions LTD., STREET=Akademica Vernadskogo blvd. 36-507, L=Kiev, S=Kiev, PostalCode=03451, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0FB283CB6EEA8D0204BFA51C4BCE925C

File PE Metadata
Compilation timestamp:
2/27/2013 9:33:30 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
384:aDpad1w3aQ7dftde7gPB/CxV8xXGGPOJSVG:0mdQJtde7g5K8dG3Sw

Entry address:
0x3B4E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.8922

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
7 KB (7,168 bytes)

Scheduled Task
Task name:
Escolade

Trigger:
Daily (Runs daily at 11:04 PM)

Action:
updater.exe i www.anyfiledownloader.com


The file Updater.exe has been discovered within the following program.

iPumper Installer  by Escolade Solutions LTD
iPumper is a download manager and just a re-branded/distributed version of "Fast File Downloader" by www.anyfiledownloader.com. Which is distributed by FreeMediaPack that bundles potentially unwanted programs includeing toolbars.
products-placement.com/ipumper
81% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to 2a.6a.acb8.ip4.static.sl-reverse.com  (184.172.106.42:80)

TCP (HTTP):
Connects to no.rdns.ukservers.com  (94.229.72.115:80)

TCP (HTTP):
Connects to dmpro-ca-01.fooservers.com  (167.114.156.214:80)

Remove Updater.exe - Powered by Reason Core Security