OneBrowser
Kad Skor Ancaman
Kad Skor Ancaman EnigmaSoft
Kad Skor Ancaman EnigmaSoft ialah laporan penilaian untuk ancaman perisian hasad yang berbeza yang telah dikumpulkan dan dianalisis oleh pasukan penyelidik kami. Kad Skor Ancaman EnigmaSoft menilai dan menilai ancaman menggunakan beberapa metrik termasuk faktor risiko dunia sebenar dan potensi, arah aliran, kekerapan, kelaziman dan kegigihan. Kad Skor Ancaman EnigmaSoft dikemas kini secara berkala berdasarkan data dan metrik penyelidikan kami dan berguna untuk pelbagai pengguna komputer, daripada pengguna akhir yang mencari penyelesaian untuk mengalih keluar perisian hasad daripada sistem mereka kepada pakar keselamatan yang menganalisis ancaman.
Kad Skor Ancaman EnigmaSoft memaparkan pelbagai maklumat berguna, termasuk:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Tahap Keterukan: Tahap keterukan objek yang ditentukan, diwakili secara berangka, berdasarkan proses dan penyelidikan pemodelan risiko kami, seperti yang dijelaskan dalam Kriteria Penilaian Ancaman kami.
Komputer yang Dijangkiti: Bilangan kes yang disahkan dan disyaki bagi ancaman tertentu yang dikesan pada komputer yang dijangkiti seperti yang dilaporkan oleh SpyHunter.
Lihat juga Kriteria Penilaian Ancaman .
| Popularity Rank: | 34 |
| Tahap Ancaman: | 20 % (Biasalah) |
| Komputer yang Dijangkiti: | 7,946 |
| Pertama Dilihat: | January 27, 2026 |
| Kali terakhir dilihat: | May 9, 2026 |
| OS (es) Terjejas: | Windows |
Aplikasi yang tidak boleh dipercayai yang memanipulasi tetapan penyemak imbas tanpa kebenaran mewakili risiko yang ketara kepada keselamatan dan privasi dalam talian pengguna. Program ini, yang dikategorikan sebagai Program Berpotensi Tidak Diingini (PUP), boleh mengubah cara pelayar berfungsi, mengubah hala trafik ke tapak yang dipersoalkan dan menjejaki aktiviti penyemakan imbas untuk pengumpulan data. Salah satu perampas pelayar yang mengganggu ialah OneBrowser, yang mengganggu pilihan pengguna dan mempromosikan enjin carian yang meragukan. Memahami cara ia beroperasi dan merebak adalah penting untuk mengekalkan pengalaman penyemakan imbas yang selamat.
Isi kandungan
Apakah OneBrowser?
OneBrowser ialah aplikasi mengganggu yang mengubah suai tetapan penyemak imbas untuk memaksa pengguna menggunakan enjin carian yang tidak boleh dipercayai. Daripada menyampaikan hasil carian yang relevan dan boleh dipercayai, enjin ini mungkin mengutamakan kandungan yang ditaja, iklan yang mengelirukan, atau malah mengarahkan pengguna ke tapak web berisiko. Pengubahsuaian yang dikenakan oleh OneBrowser selalunya termasuk perubahan pada halaman utama lalai, pembekal carian dan tetapan tab baharu.
Setelah dipasang, perampas penyemak imbas ini juga boleh menyuntik iklan yang berlebihan ke dalam halaman web, menyebabkan ubah hala yang kerap dan memanipulasi pertanyaan carian untuk memanfaatkan rakan kongsi pihak ketiga. Pengguna sering mengalami prestasi penyemakan imbas yang lembap, tetingkap timbul yang tidak diingini dan kesukaran untuk mengembalikan tetapan penyemak imbas mereka.
Bagaimana OneBrowser Mempengaruhi Pengalaman Penyemakan Imbas
Kehadiran OneBrowser pada sistem memperkenalkan pelbagai kesulitan dan kebimbangan keselamatan. Pengguna mungkin menghadapi:
- Lencongan Paksa : Pertanyaan carian dan lawatan tapak web boleh diubah hala ke enjin carian yang meragukan atau halaman ahli gabungan yang menjana hasil untuk pengendali di sebalik OneBrowser.
- Iklan Mengganggu : Tetingkap timbul, sepanduk dan iklan dalam teks mungkin kerap muncul, membawa kepada tawaran yang boleh dipersoalkan, halaman yang mengelirukan atau promosi palsu.
- Risiko Penjejakan Data : Perampas penyemak imbas mungkin memantau tabiat menyemak imbas, sejarah carian dan butiran peribadi. Data yang dikumpul boleh digunakan untuk pengiklanan yang disasarkan atau bahkan dijual kepada pihak ketiga.
- Penyingkiran Manual Sukar : Pengguna yang cuba memulihkan tetapan penyemak imbas mereka secara manual mungkin mendapati OneBrowser berterusan, kadangkala memulihkan dirinya walaupun selepas percubaan menyahpasang.
Taktik Pengedaran PUP yang dipersoalkan
PUP seperti OneBrowser selalunya tidak bergantung pada muat turun pengguna langsung tetapi sebaliknya merebak melalui taktik pengedaran yang mengelirukan, menjadikannya sukar untuk dikesan sebelum pemasangan. Kaedah biasa termasuk:
- Himpunan Perisian: OneBrowser mungkin disembunyikan dalam pemasang aplikasi percuma daripada tapak web pihak ketiga. Pengguna yang tergesa-gesa melalui proses pemasangan tanpa menyemak pilihan mungkin secara tidak sedar membenarkannya ke sistem mereka.
- Kemas Kini Perisian Palsu: Kemas kini penipuan menggesa yang mendakwa menawarkan tampung yang diperlukan untuk penyemak imbas, pemain media atau perisian lain mungkin memasang OneBrowser secara rahsia.
- Iklan Penipuan: Mengklik pada iklan mengelirukan yang menjanjikan perkhidmatan percuma, hadiah atau peningkatan prestasi mungkin membawa kepada muat turun perisian yang mengganggu secara tidak sengaja.
- Tapak Web Terkompromi: Melawat tapak tertentu yang tidak boleh dipercayai boleh mencetuskan skrip automatik yang cuba memasang sambungan penyemak imbas yang tidak diingini atau mengubah suai tetapan penyemak imbas.
Memperkukuh Pertahanan terhadap Perampas Pelayar
Untuk meminimumkan risiko menghadapi PUP seperti OneBrowser, pengguna harus mengambil langkah keselamatan proaktif, termasuk:
- Pemasangan Perisian Berhati-hati : Sentiasa pilih tetapan 'Tersuai' atau 'Lanjutan' semasa pemasangan perisian untuk mengenal pasti dan menolak tawaran yang digabungkan.
- Mengelakkan Iklan dan Pautan Mencurigakan : Elakkan mengklik pada pop timbul atau kandungan promosi daripada sumber yang tidak diketahui, kerana ini boleh membawa kepada muat turun yang mengelirukan.
- Mengemas kini Perisian : Pastikan pelayar dan perisian penting dikemas kini hanya daripada sumber rasmi untuk mengelakkan pendedahan kepada penipuan kemas kini palsu.
- Menggunakan Alat Keselamatan Boleh Dipercayai : Perisian keselamatan dengan perlindungan masa nyata boleh membantu mengesan dan menghalang pengubahsuaian penyemak imbas yang tidak dibenarkan.
- Menyemak Sambungan dan Tetapan Secara Berkala : Semak sambungan penyemak imbas yang dipasang secara berkala dan tetapkan semula tetapan penyemak imbas jika sebarang perubahan yang tidak dibenarkan dikesan.
Dengan sentiasa berwaspada dan melaksanakan amalan keselamatan ini, pengguna boleh melindungi diri mereka dengan lebih baik daripada perampas penyemak imbas yang mengganggu dan mengekalkan kawalan ke atas pengalaman penyemakan imbas mereka.
Butiran Pendaftaran
OneBrowser boleh mencipta entri pendaftaran atau entri pendaftaran berikut:
File name without path
onebrowser.lnk
Regexp file mask
%windir%\system32\tasks\obupdate
%windir%\system32\tasks\onebupdate
Software\Microsoft\Windows\CurrentVersion\App Paths\OneBrowser.exe
Software\OB
SOFTWARE\OneBrowser
SOFTWARE\WOW6432Node\OB
SOFTWARE\WOW6432Node\OneBrowser
Direktori
OneBrowser boleh mencipta direktori atau direktori berikut:
| %localappdata%\ob |
| %localappdata%\onebrowser |
| %programfiles%\ob |
Laporan Analisis
Maklumat am
| Family Name: | OneBrowser |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e810fdd67f792f51677eb41147031d1e
SHA1:
64eaeeb21a0a88ecde826f57305af566909e8c97
SHA256:
6E1F84E3B1A1681C7FD2E643130433DBA9E12D442A433B0FC714E9FFC84D7FD0
Saiz fail:
6.77 MB, 6766600 bytes
|
|
MD5:
04871138a46b1e55c4898530c95be835
SHA1:
cde11f7d08536e148b8c70182cb66a389200f9d8
SHA256:
DF1B14CCD5D08C61E8BB2327D1AF264E09D7274C49F21D84E6141209875ACF71
Saiz fail:
15.37 KB, 15368 bytes
|
|
MD5:
952071dcb852425349ad191050699518
SHA1:
b5825f3a889b9e1b0cf380230158ca16f62184c1
SHA256:
0055AE7323E8FBC5FAD5FC3E651929DEBF6EBB82D2CF3C885C71ED03E4E8A336
Saiz fail:
4.25 MB, 4251144 bytes
|
|
MD5:
0eb3d14380dd71d54dff49a641b48036
SHA1:
7f06413aa0b71f815e49f63944d84cf7e0c926a8
SHA256:
1A2E843630CE3CF0AB4FCEC4D4A259FEFD792EF2C0BB108A1E658B23CA5F781A
Saiz fail:
4.07 MB, 4070408 bytes
|
|
MD5:
c5f5c43c21d5e96466bc89f636369faa
SHA1:
76ff31a1625519f9cfe7e950abfb80412f4c2918
SHA256:
A40D4C0285751682187667B96CDB9C2ED036FD4C275B05B07BA41E3F6C8ECFBF
Saiz fail:
12.82 KB, 12816 bytes
|
Show More
|
MD5:
9d99e2bb05e6983e4c9d8d0d1384b29f
SHA1:
bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6
SHA256:
7169C12461282FFD238DFAC0908F48680E479894187A64D0EA574FBA900FA8AA
Saiz fail:
103.84 KB, 103840 bytes
|
|
MD5:
4cacef2c307a98bb584b065485f6419d
SHA1:
0624e96b1303911965f4857b146f75d2965a0fe2
SHA256:
FAF7AB545E70A97E5BCC3C58A98962D27C91AA96E8AE0994CF27AD5E5D964917
Saiz fail:
12.82 KB, 12816 bytes
|
|
MD5:
421111e2e972c2dc02509565dfe58b9a
SHA1:
0ca767ac8acb598cdedd6ad711234ab74f68389c
SHA256:
7016BD65896DA09D15CDA98C974D9F7AEA9F7A1EC1B8BA89BBA6B6E024DCE6E9
Saiz fail:
104.35 KB, 104352 bytes
|
|
MD5:
483f9c126954a555c10f26f976a32f50
SHA1:
33eba8b9ed316a3718b90e72d37819986d249b9a
SHA256:
64EC17CF92438D0A961CC67B367E5D3F499DCD4E90A3239D81B685D18E80AD8E
Saiz fail:
3.31 MB, 3309584 bytes
|
|
MD5:
48d3eb964fd9b62572d77e98a8a6aa15
SHA1:
649e71c6405a5f4ba101c7cd50f336492d8438b3
SHA256:
40BBF1D5AE1CF313AA31467BDB51F3A7D1D412BF3A5C262D6AB481F089D887C5
Saiz fail:
12.82 KB, 12816 bytes
|
|
MD5:
dba03ab3be9f17a389166b7369e2acc4
SHA1:
57e9c9c3b26315504cddbcb43f9d54722505ec4d
SHA256:
48AC6CC9978B7F63F23D6420F76BBCAC97243D16D19C25C9D5ADCA47FBF587A3
Saiz fail:
91.66 KB, 91664 bytes
|
|
MD5:
78c66c9be1bef8db266c0dfca55640ae
SHA1:
3d7ec646ef62f1ccf613da86163db98a2cf5a856
SHA256:
55EDBBE4767D8375CE732893478CA78FAF0B3C2CE44E169AD18E55C66533B03D
Saiz fail:
4.25 MB, 4251144 bytes
|
|
MD5:
a36f5d837ad1411aadd1d051564a07b7
SHA1:
cbdaea221176488c5d69fbe8ebc869b59c4a5ab0
SHA256:
B44B6C273DA470D8BC9A6D21501CCCD7E32DA794A91F02EB2F0A7428F2F7E510
Saiz fail:
6.84 MB, 6839816 bytes
|
|
MD5:
5aa120ee57bf8dbe30e78ced9d1c7e0f
SHA1:
b60364cde63fc62fd33cd4b782926f33f7d6d126
SHA256:
9BEC78B77027742A72E215AC24775F7CC27930987333D47C60A6BD953A3F58C9
Saiz fail:
6.85 MB, 6854152 bytes
|
|
MD5:
b912ff7b2e3bafff09e790b5c6325034
SHA1:
9ca5c68665f67646d361349af0b48332e69b28a4
SHA256:
58593A82A2E26D37CF4752985CD38B4DCD1E15720664E0C4A45E9D18C2EB7C94
Saiz fail:
15.37 KB, 15368 bytes
|
|
MD5:
3137246262b9b0467ecc01033147cf28
SHA1:
788d0f7d5253e84c34a220e92dbcb5866cd0f713
SHA256:
7308680634A887944EFE20288C5A187DE6F1BD9CBCC81A62B2F88601ABAB1242
Saiz fail:
5.43 MB, 5432840 bytes
|
|
MD5:
3f3e0fedb534c5b8b2b5a04e7a021f17
SHA1:
8cc5ce48e553e73d798f2ce178c96c177f07ac15
SHA256:
493E6B44B84ACCFC38C05C9C1011B944E9AB4115830D8D8A3EFA35A76DD901B2
Saiz fail:
6.85 MB, 6854664 bytes
|
|
MD5:
bad70f661b1a50f4d5785e1680c60ebf
SHA1:
0feb753ffec52f6c8e7f50a4c9146a0b8a4b87a2
SHA256:
67107FB66F5C8BB5601F35A7E6B16D84A6920F3A2A639ADFC848DAA221295795
Saiz fail:
4.80 MB, 4800008 bytes
|
|
MD5:
1e17bf103f32f7406c73ddbbd6da1618
SHA1:
160fac2e0905ec8f3128439b99b2a255994d6af8
SHA256:
3D396E49DB2395547B7B23DF2B9DBC8928A09300A9E455DF27D46A3BBBDEEEAF
Saiz fail:
3.37 MB, 3373064 bytes
|
|
MD5:
3654eb0cc6e4caf49709a06cffb87932
SHA1:
93bd5ab386c328249179781710dcbd16f96cbb40
SHA256:
91ABCF473E6D0C68519B911D7A87A16C2AEB744520BA71FCA5CC3859068E56B8
Saiz fail:
4.80 MB, 4800008 bytes
|
|
MD5:
be43e3ecfdfe09d3652cdf982a89506a
SHA1:
f2b2f2e4a994a5c0d1db4245b7f9d34d685abe85
SHA256:
9437A1E6BE6BC6C7A9F9EF9F626CF22DDAF577BB490A431984313C89C5E0EB4B
Saiz fail:
4.40 MB, 4404128 bytes
|
|
MD5:
79a53ad54109938cc7a719aed40308d1
SHA1:
33bc9d3e704d4df6e1b990f92759f590d51f40a6
SHA256:
14F867858C8136C1F27DA6A5E2076F59BFE22C0DD14A0B3F37267726CA7A9CE2
Saiz fail:
4.80 MB, 4803592 bytes
|
|
MD5:
2dd98794fb9899a0e049abb3740112f3
SHA1:
54ed54fc13e122cfc5e6d3308d2b7a08109270d0
SHA256:
8D0AFBF2170365F183652E30665F7BB49AF2E9EF97E386357C2E701950A7381C
Saiz fail:
1.13 MB, 1125384 bytes
|
|
MD5:
4e64a6b07cad0374c5c669db6033f00a
SHA1:
c751a871a85ed16977f37f0368b7957fef8780fa
SHA256:
03A1954EF413E1A0E726EE5F698BE789A8F73B177B16B7D368EB25DC08B6251A
Saiz fail:
6.39 MB, 6394376 bytes
|
|
MD5:
8be3bab07f56a27340d3c4085199b328
SHA1:
580a6926fb10643b051732342154f00e8ec89834
SHA256:
E5E27D211DEF4402191DF38965E617DB3D4119214AC6312BC2F57035B2F39171
Saiz fail:
1.13 MB, 1125384 bytes
|
|
MD5:
22e7ed32ef96aed2c586e3e1bcdb09ba
SHA1:
60ef5f005679bcc5840f0db732ae7e36986a6869
SHA256:
946092B728161763441081F2D566647810A2CF22D45EB7CA88BA54C9CE96200D
Saiz fail:
12.82 KB, 12816 bytes
|
|
MD5:
77e27eb2a734029549a7e99e01d94bf7
SHA1:
8b9f6944c9e309f0fa4aeb63585368810d2b9cc9
SHA256:
D72A2FFE92066E02B1E66C292CAF3CDCA5B85446D0E9E7E056B07F651E8CAB25
Saiz fail:
4.79 MB, 4785664 bytes
|
|
MD5:
cc53180a0cf9a64c18337b29cbe72b2f
SHA1:
1be5742e97ba1c4bbf96b6edeb6ec5748bc7ec0e
SHA256:
CC16C93EB4DAFB329ECE937A9CFCF844E72D27E52DA50F094B74EE16D657D2C6
Saiz fail:
6.36 MB, 6355976 bytes
|
|
MD5:
631bcb8ac338d0d9af71f58f24e43e06
SHA1:
a8040ff82646b15d77cccd7d8ada3a136baf82e8
SHA256:
DEA2F01D1A8A43636596A0766FBF61DEB1705D97F94878C058917FB65DE10D1B
Saiz fail:
4.78 MB, 4779584 bytes
|
|
MD5:
8177a190a97f9e8d395a4d52a1e04732
SHA1:
c48d96b8444bf2b6c96317c3a92f1eb20ea325b4
SHA256:
8E68C92FB203A835774A038FEE0140035227D8CC13AFE66FFB8438DBE15E95B0
Saiz fail:
1.09 MB, 1093128 bytes
|
|
MD5:
83200f4fd455cf9563094a6bddaf701c
SHA1:
5bbff61f436e12b4158b8afddec110074ed1dc13
SHA256:
78537CF18FFF61171102194C1F7E83871E7132C57C0509745F16DDA96EAA4127
Saiz fail:
4.81 MB, 4806224 bytes
|
|
MD5:
8f6401fd5416fbd0f9beb6ee831336cb
SHA1:
fa527f255dc7b2d574fd8d9054d2d9d03208c230
SHA256:
9031E155F9E9502ADD6D802AE4F9E750187DF6EDE797510677E64719C73B3BA9
Saiz fail:
6.36 MB, 6357512 bytes
|
|
MD5:
ef5f5eef9fc436caffbaf5dc2752c305
SHA1:
b747fb4415891770fb0980b664f7fd7f71505a8c
SHA256:
BBBFA59D700625F0CB13DD983D1D9C08A0067401BF6D4A447CEF3AB3563FD76F
Saiz fail:
6.36 MB, 6358024 bytes
|
|
MD5:
8e4c11994d82fc83a2625cb4e94333eb
SHA1:
4b65999bafa09782dc8f5469645368b2b70cf475
SHA256:
9E84E4CF50BC69A8694381F2EF91A7AE697A36FA666EB51386EF20C74DC0E114
Saiz fail:
4.78 MB, 4782096 bytes
|
|
MD5:
a4156b8ded211bee377c0c358719d537
SHA1:
bb1d154ec7eb2afe6838710b5d13d370047ba069
SHA256:
9CD72886F67D66C461C52193A6EE484825DF2568DF5034177B0FBEE7A9B758DD
Saiz fail:
4.79 MB, 4786096 bytes
|
|
MD5:
92c84c26710dd680979a6b618b3f7d23
SHA1:
62ab04a4c0e77260c6ad7e9c4ff5df160d087590
SHA256:
3D37E95B2B622D3D84E6505F48DB641A8674520DFB70A33EE1832F7332784E7A
Saiz fail:
6.34 MB, 6340104 bytes
|
|
MD5:
dffe7a4a9cb056f6f71bb739cdf1ff5d
SHA1:
7404a6fec8e3c7c1fe535fff4fdcc4266224f064
SHA256:
1FD27E9A208AD1C11A19992E90ECD833B0A371B915D4CC234880E5B711FC5B3D
Saiz fail:
6.37 MB, 6368264 bytes
|
|
MD5:
fc7e187cce29f07ef2ce72884357f4f2
SHA1:
b18466e39fb647a643d45520800da110f5ca5ee1
SHA256:
DD9AEDDBE60A6510E4381791A34A2B0322B67279A2762C989908565C321581B2
Saiz fail:
4.79 MB, 4791664 bytes
|
|
MD5:
f7de35764c38328ea298e03879f0512c
SHA1:
d404f62b045217b5666a48d8a163fc2a307f624c
SHA256:
48800AF6A7FE9351BD8D6512D2EB9525F9D4905EA231EB6BF5CF8CF6910599B2
Saiz fail:
4.78 MB, 4780080 bytes
|
|
MD5:
85fa94e89236e2a579a7270535e1a286
SHA1:
3ac282ba9953c8c18de356967714e442287b49af
SHA256:
4B5F4C3738222374DD215B438A364DC432ACC78D26C1C87B4BE628CB94D7CC15
Saiz fail:
6.33 MB, 6330376 bytes
|
|
MD5:
d7088bdf86ba8b0c3986052cb304590d
SHA1:
c92f1618edd17709bbd9fd7e962094464653a722
SHA256:
3E08AF0B519B65632A26CD6B8D1092C6B437865722DA9107938B58238954C8B5
Saiz fail:
6.43 MB, 6434312 bytes
|
|
MD5:
45564e53f6cfffda92307d9f6491c116
SHA1:
049ffaba2dd8e6351603d799c95c262a88da2b80
SHA256:
3188FEFF7C735121E440E83F550BE6D270ABDA338E5619E9D8E4DD0EE345ADA0
Saiz fail:
4.87 MB, 4867664 bytes
|
|
MD5:
b79cb8ab4ba77e28efcb1a639ac5bf7d
SHA1:
6ffed8d461c98c0c38d2a7f2273f031bf98ab74f
SHA256:
508DBD18F539D681004A07443C8B5D812F3924586C9A33010069FEBC6F3EE67E
Saiz fail:
6.35 MB, 6351880 bytes
|
|
MD5:
7884342ae405b6ce6467da589c90e355
SHA1:
f61def98539ae152e53707f3e403ab76bb359172
SHA256:
405453417C7E570BE27D7EDBB6CC284629B107CA08242974778091FBDB13B0FE
Saiz fail:
1.09 MB, 1094664 bytes
|
|
MD5:
de65aabcb1de7dd4a981fb03d18b84c3
SHA1:
e5ee7c2f07a526851676573c2cb2d2ac042e83fb
SHA256:
479725DA5C4099960CD4FBBC9A1CAAE143A17C88F4962CA64FD672156645A837
Saiz fail:
14.86 KB, 14856 bytes
|
|
MD5:
1d5e29c75b65681eb592cd06c4738d06
SHA1:
33fb7f0a248c5262359eb104ff465f9f778c169d
SHA256:
138C92DE1F22CF2A3F85B3AB2A0E2E3FDBB75651B980A8F30A90DE97172969B3
Saiz fail:
984.58 KB, 984584 bytes
|
|
MD5:
5a48fadbd8ff678f2a190521501b5b17
SHA1:
7cc00da47c4982c716073bc7c52d2978530ac6a2
SHA256:
77C100FE8F0CBEEB69BAEBAA726A5727E2D7947C37DE8C7DB02F3BE25BD78855
Saiz fail:
4.95 MB, 4946048 bytes
|
|
MD5:
1c253ab9fd2c1cbef193826cc840b400
SHA1:
c140f1af4a7c53549d31f51bf46a99283f8e78ff
SHA256:
CF983548547DDAF5A343AFC8BD3549C86C7E42D3760D88E14B71124E07A625AE
Saiz fail:
4.90 MB, 4899600 bytes
|
|
MD5:
3e7a97e727d9c295b76841d91083763f
SHA1:
b13542a46f67384b8140f3a22fd028bb418d07c0
SHA256:
9840CF002AA15970AE67866D7168B31F6C82C36E7245960483C6F361E82740D8
Saiz fail:
96.78 KB, 96776 bytes
|
|
MD5:
7a0bbb50c7e7ec2c4665b022fc5ba537
SHA1:
c2ea6d0cb3be884a5fbf8d59b5f9afedbe802cc1
SHA256:
E6446E3E120BEE9E2C9099AEC0FCD42D36B53F2FC464D8BE0C8CB4B78F7167B1
Saiz fail:
1.12 MB, 1121288 bytes
|
|
MD5:
51e7958d1792922a7c7507a64791aa6e
SHA1:
1f3f0e5350fed5a6aa76cb49d137ac9f5227aee0
SHA256:
877A0E189FE260AF5018F398F7627A057166BE6BDD4B9C992C49B212EEC3599B
Saiz fail:
15.37 KB, 15368 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| nama | Nilai |
|---|---|
| Company Name |
|
| Company Short Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Last Change |
|
| Legal Copyright |
Show More
|
| Official Build | 1 |
| Original Filename |
|
| Product Name |
Show More
|
| Product Short Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Work Product Inc. | GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1 | Self Signed |
| WORK PRODUCT, INC. | SSL.com EV Code Signing Intermediate CA RSA R3 | Self Signed |
| Chickadee Digital, LLC | Sectigo Public Code Signing Root R46 | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 2 |
| Unknown Blocks: | 2 |
Visual Map
0
?
?
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.AN
- Kryptik.CBX
- Kryptik.CBXA
- OneBrowser.A
- ShellcodeRunner.IB
Show More
- Trojan.Agent.Gen.AJG
- Trojan.Agent.Gen.APA
- Trojan.Agent.Gen.BNV
- Trojan.Agent.Gen.SX
- Trojan.Downloader.Gen.SA
- Trojan.Kryptik.Gen.COR
- Trojan.Kryptik.Gen.DGK
- Trojan.Kryptik.Gen.DZB
- Trojan.ShellcodeRunner.Gen.FF
- Trojan.ShellcodeRunner.Gen.NW
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\72fa0ff3_obupdate.conf | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\onebrowser::hb | RegNtPreCreateKey | |
| HKLM\software\wow6432node\onebrowser::72fa0ff3_installid | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Network Wininet |
|
| Anti Debug |
|
| Network Winhttp |
|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Service Control |
|
| Network Winsock2 |
|
| Network Winsock |
Show More
|
| Encryption Used |
|
| User Data Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\cde11f7d08536e148b8c70182cb66a389200f9d8_0000015368.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\76ff31a1625519f9cfe7e950abfb80412f4c2918_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6_0000103840.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0624e96b1303911965f4857b146f75d2965a0fe2_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0ca767ac8acb598cdedd6ad711234ab74f68389c_0000104352.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\649e71c6405a5f4ba101c7cd50f336492d8438b3_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57e9c9c3b26315504cddbcb43f9d54722505ec4d_0000091664.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9ca5c68665f67646d361349af0b48332e69b28a4_0000015368.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\60ef5f005679bcc5840f0db732ae7e36986a6869_0000012816.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e5ee7c2f07a526851676573c2cb2d2ac042e83fb_0000014856.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b13542a46f67384b8140f3a22fd028bb418d07c0_0000096776.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1f3f0e5350fed5a6aa76cb49d137ac9f5227aee0_0000015368.,LiQMAxHB
|
