» 3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll
Overview
Analysis
File Details
Programs (1)

3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll

BadFinger Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module 3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll by BadFinger Project (BrightCircle Investments Limited) has been detected as adware by 10 anti-malware scanners. This file is typically installed with the program Radio Canyon by Bright circle investments Ltd. which is a potentially unwanted software program. The library is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

BadFinger Project (BrightCircle Investments Limited) (signed and verified)

MD5:

aa5d4cbc2b6d8c8d7572bcb68e0fa58a

SHA-1:

304e06cde55672992edcc14a87935964580e6bd6

SHA-256:

0b0f1514831b39e3e204a2a24926f03865c537c5c31218d31c4d6cab957fefc3

Scanner detections:

10 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

5/2/2024 5:08:07 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/CrossRider.Gen7

7.11.193.22

AVG

Generic

2016.0.3238

Baidu Antivirus

PUA.Win32.CrossRider

4.0.3.1516

ESET NOD32

Win32/Toolbar.CrossRider.BM (variant)

9.10834

Fortinet FortiGate

Adware/Adwapper

1/6/2015

IKARUS anti.virus

Trojan.GoogUpdate

t3scan.1.8.5.0

Kaspersky

not-a-virus:AdWare.NSIS.Adwapper

14.0.0.2683

Malwarebytes

PUP.Optional.Crossrider

v2015.01.06.08

Qihoo 360 Security

Win32/Virus.Adware.a87

1.0.0.1015

Reason Heuristics

Adware.BrightCircle.BadFingerProjectBrightCircleInvestmentsLimited.e

15.1.6.8

File size:

145.5 KB (148,960 bytes)

File type:

Dynamic link library (Win64 DLL)

Language:

English (United States)

Common path:

C:\Program Files\3276cf54-c8d8-42f4-bae2-cdebf03e2a29\3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll

Digital Signature

Signed by:

BadFinger Project (BrightCircle Investments Limited)

Authority:

COMODO CA Limited

Valid from:

11/17/2014 2:00:00 AM

Valid to:

11/18/2015 1:59:59 AM

Subject:

CN=BadFinger Project (BrightCircle Investments Limited), O=BadFinger Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6623FAFCAC357577A31D90C1E567E9A7

File PE Metadata

Compilation timestamp:

12/3/2014 1:02:28 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:Jj/8DzKoizTG3BHbizJjaQr0biUR58c+zxCP9DFam:JPowT+BUJvIbii57tP93

Entry address:

0x7418

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, BF, 2E, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, 4C, B3, 01, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF... 
[+]

Code size:

81 KB (82,944 bytes)

The file 3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll has been discovered within the following program.

Radio Canyon by Bright circle investments Ltd.

Radio Canyon (Porter Studio Plus) is an adware program (supported by various types of advertising) that is usually bundled by third party installers and download managers.

88% remove it

Remove 3276cf54-c8d8-42f4-bae2-cdebf03e2a29.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.