» 9acd1534e8f840cbb5ac.dll
Overview
Analysis
File Details

9acd1534e8f840cbb5ac.dll

Scan Tack

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module 9acd1534e8f840cbb5ac.dll by Scan Tack has been detected as adware by 20 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

Scan Tack (signed and verified)

MD5:

9f934daad0753f9343d58621aeaec509

SHA-1:

642ade5984906d8cab763a0efb122272dab875f5

SHA-256:

7586b179401025dfb1c5e52a512baf8bee9518e40cc3922714dce25afeb18dae

Scanner detections:

20 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/19/2024 1:32:25 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.Y

837

Agnitum Outpost

Riskware.Agent

7.1.1

Avira AntiVirus

ADWARE/BrowseFox.Gen2

7.11.180.40

avast!

Win32:BrowseFox-J [PUP]

141003-0

AVG

Generic

2015.0.3315

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.141021

Bitdefender

Adware.SwiftBrowse.Y

1.0.20.1470

Clam AntiVirus

Win.Adware.Swiftbrowse-546

0.98/21411

Dr.Web

Trojan.BPlug.301

9.0.1.05190

Emsisoft Anti-Malware

Adware.SwiftBrowse.Y

14.10.21

ESET NOD32

probably Win32/BrowseFox.N potentially unwanted application

7.0.302.0

F-Secure

Adware.SwiftBrowse.Y

11.2014-21-10_3

G Data

Adware.SwiftBrowse

14.10.24

McAfee

BrowseFox

5600.6971

MicroWorld eScan

Adware.SwiftBrowse.Y

15.0.0.882

NANO AntiVirus

Riskware.Win32.Kranet.dgstaw

0.28.2.62841

nProtect

Adware.SwiftBrowse.Y

14.10.21.01

Reason Heuristics

PUP.ScanTack.U

14.10.21.7

Sophos

Browse Fox

4.98

VIPRE Antivirus

Yontoo

34114

File size:

190.3 KB (194,848 bytes)

File type:

Dynamic link library (Win32 DLL)

Common path:

C:\Program Files\scantack\bin\9acd1534e8f840cbb5ac.dll

Digital Signature

Signed by:

Scan Tack

Authority:

VeriSign, Inc.

Valid from:

1/22/2014 1:00:00 AM

Valid to:

1/23/2015 12:59:59 AM

Subject:

CN=Scan Tack, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Scan Tack, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

44D91A3142283CE62B23F23C84838B0D

File PE Metadata

Compilation timestamp:

10/13/2014 1:32:14 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:SP37RBT2symmM3xx0y9dH0Xhk7IQ0Li41iTzYG5vVkc7qzX9PfDqds5:SPLjrX9dH0Xhe8i41EzYGNVVGz9nDas

Entry address:

0x11BED

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 81, 7C, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, D0, 45, 02, 10, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 34, 40, 02, 10, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64... 
[+]

Code size:

139.5 KB (142,848 bytes)

Remove 9acd1534e8f840cbb5ac.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.