» dealkeeperbho.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

dealkeeperbho.dll

Deal Keeper

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module dealkeeperbho.dll by Deal Keeper has been detected as adware by 27 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Deal Keeper’. This file is typically installed with the program Deal Keeper by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

dealkeeperbho.dll

Publisher:

Deal Keeper (signed and verified)

Product:

Deal Keeper

Version:

1.0.0.3

MD5:

f3399945400074e351f04a240098f03a

SHA-1:

2cd62d7fb39a710c073ce5b685a898b56adfde9e

SHA-256:

5203a3deb513e3a620c62e060539ca7d191f74ef0d0bfca9f27fd5e5c469cacc

Scanner detections:

27 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/19/2024 6:51:43 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.BHO.Agent.4

920

Agnitum Outpost

Trojan.BPlug

7.1.1

AhnLab V3 Security

Adware/Win32.Agent

2014.08.07

Avira AntiVirus

APPL/BrowseFox.Gen2

7.11.164.128

AVG

Generic5

2015.0.3398

Baidu Antivirus

Adware.Win32.Agent

4.0.3.14729

Bitdefender

Gen:Variant.Adware.BHO.Agent.4

1.0.20.1050

Comodo Security

Application.Win32.Altbrowse.AK

19016

Dr.Web

Trojan.BPlug.28

9.0.1.0210

Emsisoft Anti-Malware

Gen:Variant.Adware.BHO.Agent

8.14.07.29.07

ESET NOD32

Win32/BrowseFox (variant)

8.10173

F-Prot

W32/BadBHO.AW.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.BHO.Agent.4

11.2014-29-07_3

G Data

Gen:Variant.Adware.BHO.Agent

14.7.24

Kaspersky

not-a-virus:AdWare.Win32.Agent

14.0.0.3486

Malwarebytes

PUP.Optional.DealKeeper.A

v2014.07.29.07

McAfee

Artemis!F02B6C030721

5600.7054

MicroWorld eScan

Gen:Variant.Adware.BHO.Agent.4

15.0.0.630

NANO AntiVirus

Riskware.Win32.Agent.cqycvd

0.28.2.61148

nProtect

Adware.MPlug.Q

14.08.01.01

Panda Antivirus

Trj/CI.A

14.07.29.07

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Reason Heuristics

Adware.Yontoo.BHO.N

14.8.15.17

SUPERAntiSpyware

Adware.BrowseFox/Variant

10453

Trend Micro House Call

Suspicious_GEN.F47V0725

7.2.210

Vba32 AntiVirus

AdWare.Agent

3.12.26.3

VIPRE Antivirus

Yontoo

31728

File size:

243.7 KB (249,592 bytes)

Product version:

1.0.0.3

Original file name:

Deal KeeperIEClient.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\deal keeper\dealkeeperbho.dll

Digital Signature

Signed by:

Deal Keeper

Authority:

VeriSign, Inc.

Valid from:

7/21/2014 7:00:00 PM

Valid to:

5/12/2015 6:59:59 PM

Subject:

CN=Deal Keeper, O=Deal Keeper, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

2D5A91A625D274EE29AFF6E5DC4A33AC

File PE Metadata

Compilation timestamp:

7/29/2014 1:19:16 PM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:oLjOFJPJ/EshAeq+hilsfFoWW+v543+0EIaIPpvLrc/:oLjwXhlq+YW/gHEIxD4/

Entry address:

0x12844

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 40, 2D, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 24, 68, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 9C, A1, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Entropy:

6.3678

Developed / compiled with:

Microsoft Visual C++

Code size:

159 KB (162,816 bytes)

Internet Explorer BHO

Display name:

Deal Keeper

CLSID:

{1ec8187a-6435-44e3-bbe4-6ce6d3c69254}

The file dealkeeperbho.dll has been discovered within the following programs.

Buzzdock by Alactro LLC

This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.

www.buzzdock.com/faq-support

79% remove it

Deal Keeper by Yontoo Technology, Inc.

Deal Keeper is an web browser advertisement extension that delivers ads to the user's web browser. Ads are in the form of traditional banners as well as context-hyper links.

mightydealkeeper.com/support

86% remove it

Remove dealkeeperbho.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.