» cinema-dplus3-bho64.dll
Overview
Analysis
File Details
Programs (1)

cinema-dplus3-bho64.dll

Cinema-DPlus3

Motoko Group

This adware utilizes the Crossrider extension platform and will inject advertisiments in the Internet browser and may modify core browser settings. Ads will be delivered as banners and contextual text-links and may promote other potentially unwanted software. The module cinema-dplus3-bho64.dll, “Cinema-DPlus3 BHO” by Motoko Group has been detected as adware by 6 anti-malware scanners. This file is typically installed with the program Cinema-DPlus3 by Motoko Group which is a potentially unwanted software program. This is the 64-bit version of the Browser Helper Object (BHO) for the Crossrider web browser platform for Internet Explorer. Instead of utilizing a traditional IE Toolbar, Crossrider installs a BHO in the browser in order to manage the functionality of CinemaD3 addon. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

CinemaD3 (signed by Motoko Group)

Product:

Cinema-DPlus3

Description:

Cinema-DPlus3 BHO

Version:

1000.1000.1000.1000

MD5:

0d8c7188d1320301acadb4fd40367881

SHA-1:

ead519e1085353a063470158d5b5114c5f756f69

SHA-256:

28f11f678b95d938f4bd77e8151cf8b646c8e5da949a1feea7434405e84bf380

Scanner detections:

6 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform. It will run as a BHO in Internet Explorer.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Motoko Group.

Analysis date:

4/20/2024 2:40:54 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/CrossRider.Gen2

7.11.163.164

ESET NOD32

Win64/Toolbar.Crossrider (variant)

8.10142

IKARUS anti.virus

AdWare.Adload

t3scan.1.6.1.0

Malwarebytes

PUP.Optional.CinemaHD.A

v2014.07.23.11

Reason Heuristics

PUP.Crossrider.MotokoGroup.T

14.7.27.13

VIPRE Antivirus

Crossrider

31530

File size:

760.4 KB (778,600 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Cinema-DPlus3.dll

File type:

Dynamic link library (Win64 DLL)

Language:

English (United States)

Common path:

C:\Program Files\cinema-dplus3\cinema-dplus3-bho64.dll

Digital Signature

Signed by:

Motoko Group

Authority:

COMODO CA Limited

Valid from:

7/17/2014 8:00:00 PM

Valid to:

7/18/2015 7:59:59 PM

Subject:

CN=Motoko Group, O=Motoko Group, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00AAFC4F8011F7FD7C00748C990950D28A

Registration

CLSIDs:

{11111111-1111-1111-1111-110611051148}, {22222222-2222-2222-2222-220622052248}

ProgIDs:

CrossriderApp0060548.BHO.1, CrossriderApp0060548.Sandbox.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

7/22/2014 6:07:00 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:eD1+WGBZyj/pOSqk8QzY/BqUjAg26lWi6zWeQPnY5U0gYVK284JpbdU9KpXxIugJ:ZEvQ/vSzzthuK4riiiGwoiT1iUPOh20F

Entry address:

0x55BFC

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, AF, CB, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, B8, D2, 05, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF... 
[+]

Entropy:

6.2417

Code size:

496.5 KB (508,416 bytes)

The file cinema-dplus3-bho64.dll has been discovered within the following program.

Cinema-DPlus3 by Motoko Group

Cinema-DPlus is an adware web browser application that displays banner ads as well as contextual link ads that are injected in the web page.

80% remove it

Remove cinema-dplus3-bho64.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.