» 171.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

171.dll

The library 171.dll has been detected as malware by 41 anti-virus scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘VeriBrowse’. This file is typically installed with the program VeriBrowse by Revizer Technologies which is a potentially unwanted software program. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.

File name:

171.dll

MD5:

b241e69f3464de507cf37c9f819ff571

SHA-1:

877278328e3b7639769bc749cfcf88a6631e991b

SHA-256:

c74ed8ead68474114c9c10d1e578420ca30d422200d64bb1b42047b257b04aac

Scanner detections:

41 / 68

Status:

File is infected by a Virus

Explanation:

The file is infected by a polymorphic file infector virus.

Analysis date:

4/19/2024 7:38:06 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Win32.Ramnit.N

865

Agnitum Outpost

Win32.Nimnul.Gen.2

7.1.1

AhnLab V3 Security

Win32/Ramnit.G

2014.06.14

Avira AntiVirus

W32/Ramnit.C

7.11.30.172

avast!

Win32:RmnDrp

2014.9-140922

AVG

Win32/Zbot.F

2015.0.3343

Baidu Antivirus

Virus.Win32.Nimnul.$a

4.0.3.14922

Bitdefender

Win32.Ramnit.N

1.0.20.1325

Bkav FE

W32.InjectAdwaredDwnA1.PE

1.3.0.4959

Clam AntiVirus

W32.Ramnit-1

0.98/19086

Comodo Security

Virus.Win32.Ramnit.K

18539

Dr.Web

Win32.Rmnet.12

9.0.1.0265

Emsisoft Anti-Malware

Win32.Ramnit.N

8.14.09.22.01

ESET NOD32

Win32/Ramnit.H virus

8.7.0.302.0

Fortinet FortiGate

W32/Ramnit.C

9/22/2014

F-Prot

W32/Ramnit.E

v6.4.6.5.141

F-Secure

Win32.Ramnit.N

11.2014-22-09_2

G Data

Win32.Ramnit

14.9.24

IKARUS anti.virus

Virus.Win32.Ramnit

t3scan.1.6.1.0

K7 AntiVirus

Virus

13.1712403

Kaspersky

Virus.Win32.Nimnul

14.0.0.3212

Malwarebytes

Virus.Ramnit

v2014.09.22.01

McAfee

W32/Ramnit.a

5600.6999

Microsoft Security Essentials

Threat.Undefined

1.175.2155.0

MicroWorld eScan

Win32.Ramnit.N

15.0.0.795

NANO AntiVirus

Virus.Win32.Nimnul.bqjjnb

0.28.0.60253

Norman

Ramnit.AS

11.20140922

nProtect

Virus/W32.SpyEye

14.06.13.01

Panda Antivirus

W32/Cosmu.E

14.09.22.01

Qihoo 360 Security

Virus.Win32.Ramnit.A

1.0.0.1015

Quick Heal

W32.Ramnit.A

9.14.14.00

Reason Heuristics

Threat.Win.Reputation.IMP

14.9.22.12

Rising Antivirus

PE:Win32.Mgr.b!1594784

23.00.65.14920

Sophos

W32/Ramnit-A

4.98

Total Defense

Win32/Ramnit.C

37.0.10997

Trend Micro House Call

PE_RAMNIT.DEN

7.2.265

Trend Micro

PE_RAMNIT.DEN

10.465.22

Vba32 AntiVirus

Virus.Win32.Nimnul.b

3.12.26.0

VIPRE Antivirus

Threat.4732184

29708

ViRobot

Win32.Nimnul.A

2011.4.7.4223

Zillya! Antivirus

Virus.Nimnul.Win32.2

2.0.0.1823

File size:

184.5 KB (188,928 bytes)

File type:

Dynamic link library (Win32 DLL)

Common path:

C:\Program Files\veribrowse-soft\171.dll

Registration

CLSID:

{D709ACA4-CABE-3A4E-D85B-9C5131B72B02}

COM registered:

Yes

File PE Metadata

Compilation timestamp:

5/22/2014 10:39:40 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:0gBL/AqpuJ7glwi/VudJwRiPf76R+jsCgfJ8TCfInJHI/G8g:zl/Apd40dJkKGl23HIex

Entry address:

0xCA59

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, B7, 5E, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 68, 13, 02, 10, E8, E8, 3F, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 60, 4E, 02, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 68, B1, 01, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Entropy:

6.4330

Developed / compiled with:

Microsoft Visual C++

Code size:

97.5 KB (99,840 bytes)

Internet Explorer BHO

Display name:

VeriBrowse

CLSID:

{D709ACA4-CABE-3A4E-D85B-9C5131B72B02}

The file 171.dll has been discovered within the following program.

VeriBrowse by Revizer Technologies

VeriBrowse is an web browser advertisement injection extension that is designed with the core purpose of delivering ads to the user's web browser. Ads are in the form of banners (both static and videos) as well as context-hyper links.

81% remove it

Remove 171.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.