home

0afa457d-63ed-49a9-9046-ddaae13378a6.dll

BadFinger Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module 0afa457d-63ed-49a9-9046-ddaae13378a6.dll by BadFinger Project (BrightCircle Investments Limited) has been detected as adware by 17 anti-malware scanners. The library is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
BadFinger Project (BrightCircle Investments Limited)  (signed and verified)

MD5:
bbb40d6b1fb6e8aa1cf362f37abc9d1e

SHA-1:
d8ca52f2d39466bf75d31427d25cfe85c87bd569

SHA-256:
e377f3ed63e9c027e8b93823a878306cf20aba7a252ba17c7e9e054342b9e97c

Scanner detections:
17 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
4/19/2024 4:06:56 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Adwapper
7.1.1

AhnLab V3 Security
Win-PUP/CrossRider
2015.03.29

Avira AntiVirus
ADWARE/CrossRider.Gen7
7.11.193.22

AVG
Generic
2016.0.3156

Baidu Antivirus
PUA.Win32.CrossRider
4.0.3.15328

Bkav FE
W64.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Crossrider1.22993
9.0.1.05190

ESET NOD32
Win32/Toolbar.CrossRider.BM (variant)
9.10834

Fortinet FortiGate
Adware/Adwapper
7/3/2015

herdProtect (fuzzy)
variant of 3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll (Adware)
2015.7.3.8

IKARUS anti.virus
Trojan.GoogUpdate
t3scan.1.8.5.0

Kaspersky
not-a-virus:AdWare.NSIS.Adwapper
14.0.0.2276

Malwarebytes
PUP.Optional.Crossrider
v2015.03.28.08

Qihoo 360 Security
Win32/Virus.Adware.a87
1.0.0.1015

Reason Heuristics
Adware.BrightCircle
15.3.28.20

VIPRE Antivirus
Threat.4150696
38552

Zillya! Antivirus
Adware.Adwapper.Win32.4343
2.0.0.2120

File size:
145.5 KB (148,960 bytes)

File type:
Dynamic link library (Win64 DLL)

Common path:
C:\Program Files\374cb2c3-589c-4523-ad8d-2bd0f95de671\0afa457d-63ed-49a9-9046-ddaae13378a6.dll

Digital Signature
Signed by:
BadFinger Project (BrightCircle Investments Limited)

Authority:
COMODO CA Limited

Valid from:
11/17/2014 4:00:00 AM

Valid to:
11/18/2015 3:59:59 AM

Subject:
CN=BadFinger Project (BrightCircle Investments Limited), O=BadFinger Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
6623FAFCAC357577A31D90C1E567E9A7

File PE Metadata
Compilation timestamp:
12/3/2014 3:02:28 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:mj/8DzKoizTG3BHbizJjaQr0biUR58c+zxCP9DFaS:mPowT+BUJvIbii57tP9/

Entry address:
0x7418

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, BF, 2E, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, 4C, B3, 01, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF...
 
[+]

Entropy:
5.9156

Code size:
81 KB (82,944 bytes)

Remove 0afa457d-63ed-49a9-9046-ddaae13378a6.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.