» {587cb346-a3d8-4884-b39b-f0ed918b6f96}.dll
Overview
Analysis
File Details

{587cb346-a3d8-4884-b39b-f0ed918b6f96}.dll

XVRNT

TowerTilt

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module {587cb346-a3d8-4884-b39b-f0ed918b6f96}.dll, “TODO: <File description>” by TowerTilt has been detected as adware by 16 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

TODO: <Company name> (signed by TowerTilt)

Product:

XVRNT

Description:

TODO: <File description>

Version:

2.0.0.9

MD5:

43dcd7869dfb2c8385e7e29d37a51bba

SHA-1:

91d8167d990d3101299db93606e37c40eb77df81

SHA-256:

79f43efefa0d229b8994d8f8e448151a52076e718f920290264e9d3347e5abb1

Scanner detections:

16 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/18/2024 7:48:20 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Agent.NYV

1022

Agnitum Outpost

PUA.Agent

7.1.1

AVG

Generic_r

2015.0.3493

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.14425

Bitdefender

Adware.Agent.NYV

1.0.20.540

Dr.Web

Trojan.BPlug.48

9.0.1.0115

Emsisoft Anti-Malware

Adware.Agent.NYV

8.14.04.18.07

ESET NOD32

Win32/BrowseFox (variant)

8.9659

F-Secure

Adware.Agent.NYV

11.2014-18-04_6

G Data

Adware.Agent.NYV

14.4.24

herdProtect (fuzzy)

variant of albrechtoba.dll (Adware)

2014.7.7.10

MicroWorld eScan

Adware.Agent.NYV

15.0.0.324

nProtect

Adware.Agent.NYV

14.03.30.01

Reason Heuristics

PUP.TowerTilt.g

14.4.20.21

Vba32 AntiVirus

AdWare.LinkSwift

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Generic

27870

File size:

287.8 KB (294,688 bytes)

Product version:

2.0.0.9

Original file name:

XTLS.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\towertilt\bin\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.dll

Digital Signature

Signed by:

TowerTilt

Authority:

VeriSign, Inc.

Valid from:

2/3/2014 2:00:00 PM

Valid to:

2/4/2015 1:59:59 PM

Subject:

CN=TowerTilt, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TowerTilt, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0DC21B60DDFB723E55B2F05376083F29

File PE Metadata

Compilation timestamp:

4/3/2014 8:41:22 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:nUgSPzWSUYZGHOHtxMIC2XgqJu6gblXKzk1GW:UJ7WSURHONOIC2XgqJu6gblXh1GW

Entry address:

0x21887

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, CB, 84, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, B8, A7, A8, 02, 10, A3, 88, 23, 04, 10, C7, 05, 8C, 23, 04, 10, 9D, 9F, 02, 10, C7, 05, 90, 23, 04, 10, 51, 9F, 02, 10, C7, 05, 94, 23, 04, 10, 8A, 9F, 02, 10, C7, 05, 98, 23, 04, 10, F3, 9E, 02, 10, A3, 9C, 23, 04, 10, C7, 05, A0, 23, 04, 10, 1F, A8, 02, 10, C7, 05, A4, 23, 04, 10, 0F, 9F, 02, 10, C7, 05, A8, 23, 04, 10, 71, 9E, 02, 10, C7, 05, AC, 23, 04, 10, FD, 9D... 
[+]

Entropy:

6.5072

Code size:

203 KB (207,872 bytes)

Remove {587cb346-a3d8-4884-b39b-f0ed918b6f96}.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.