» clickmovie1-downloaderv10-buttonutil.dll
Overview
Analysis
File Details

clickmovie1-downloaderv10-buttonutil.dll

BadFinger Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module clickmovie1-downloaderv10-buttonutil.dll by BadFinger Project (BrightCircle Investments Limited) has been detected as adware by 28 anti-malware scanners. The ButtonUtil module (32-bit version) uses the Crossrider web extension monetization toolkit and will perform a number of helper integration activities on the user's web browser's as well as the Window's Shell in order to install the addon. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

BadFinger Project (BrightCircle Investments Limited) (signed and verified)

MD5:

af88b36f6173108749d446d454d0ccda

SHA-1:

d0edd5d5674ca5c0375a359b2c6021be5a1a3989

SHA-256:

c01d3cbc306824ec1a6dfe76386265ee20e8ebc97068db5266a84b4da7f8342b

Scanner detections:

28 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is BadFinger Project (BrightCircle Investments Limited).

Analysis date:

4/24/2024 4:28:30 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Heur.Ay5@mS9ZVxoi

737

AhnLab V3 Security

PUP/Win32.CrossRider

2015.01.27

Avira AntiVirus

ADWARE/CrossRider.Gen

7.11.205.116

AVG

Generic

2016.0.3215

Baidu Antivirus

PUA.Win32.CrossRider

4.0.3.15128

Bitdefender

Gen:Application.Heur.Ay5@mS9ZVxoi

1.0.20.140

Dr.Web

Trojan.Crossrider.48406

9.0.1.028

ESET NOD32

Win32/Toolbar.CrossRider.BD (variant)

9.11078

Fortinet FortiGate

Adware/Adwapper

1/28/2015

F-Prot

W32/S-a0b67afc

v6.4.7.1.166

F-Secure

Gen:Application.Heur.Ay5@mS9ZVxoi

11.2015-28-01_4

G Data

Gen:Application.Heur.Ay5@mS9ZVxoi

15.1.25

K7 AntiVirus

Trojan

13.192.14761

Kaspersky

not-a-virus:AdWare.NSIS.Adwapper

14.0.0.2572

McAfee

Artemis!AF88B36F6173

5600.6871

MicroWorld eScan

Gen:Application.Heur.Ay5@mS9ZVxoi

16.0.0.84

NANO AntiVirus

Riskware.Win32.Crossrider.dlagnc

0.30.0.64812

Panda Antivirus

Trj/Genetic.gen

15.01.28.12

Qihoo 360 Security

HEUR/QVM30.1.Malware.Gen

1.0.0.1015

Quick Heal

AdWare.NSIS.r6 (Not a Virus)

1.15.14.00

Reason Heuristics

Adware.Crossrider.Brightcircle

15.1.28.12

Rising Antivirus

PE:Malware.Obscure!1.9C59

23.00.65.15126

Sophos

AppRider

4.98

Trend Micro House Call

TROJ_GEN.R047C0EL914

7.2.28

Trend Micro

TROJ_GEN.R047C0EL914

10.465.28

Vba32 AntiVirus

AdWare.Adwapper

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

37004

Zillya! Antivirus

Adware.Adwapper.Win32.1595

2.0.0.2046

File size:

419.5 KB (429,536 bytes)

File type:

Dynamic link library (Win32 DLL)

Common path:

C:\Program Files\clickmovie1-downloaderv10\clickmovie1-downloaderv10-buttonutil.dll

Digital Signature

Signed by:

BadFinger Project (BrightCircle Investments Limited)

Authority:

COMODO CA Limited

Valid from:

11/17/2014 3:30:00 AM

Valid to:

11/18/2015 3:29:59 AM

Subject:

CN=BadFinger Project (BrightCircle Investments Limited), O=BadFinger Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6623FAFCAC357577A31D90C1E567E9A7

File PE Metadata

Compilation timestamp:

12/5/2014 2:34:27 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:t4y9yFkeS+BzgK0cuzxo5/qDA1bXJtGxxjeTBrUTZRvRHM5L:t4Yy9SiqznIb2teTtUT3RM5L

Entry address:

0x2A423

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 91, 97, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, C0, 56, 05, 10, E8, 0E, 36, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 08, D1, 05, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 90, BE, 04, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Entropy:

6.3741

Developed / compiled with:

Microsoft Visual C++

Code size:

276.5 KB (283,136 bytes)

Remove clickmovie1-downloaderv10-buttonutil.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.