home

dollardream.browseradapter.exe

Dollar Dream

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application dollardream.browseradapter.exe by Dollar Dream has been detected as adware by 20 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
Dollar Dream  (signed and verified)

MD5:
7c0f7cb1d85c6d651c6b153d6646b87d

SHA-1:
6c5af7a853d471a938b97d2a92ee801f447dfa39

SHA-256:
a56f7909f231abbd5522a7e82d5cc220b3ab4e6a42e56c4b0a2613934ea6f492

Scanner detections:
20 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 2:26:58 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.AG
658

AhnLab V3 Security
PUP/Win32.BrowseFox
2015.04.18

Avira AntiVirus
ADWARE/BrowseFox.Gen
3.6.1.96

avast!
Win32:BrowseFox-FR [PUP]
2014.9-150719

Bitdefender
Adware.BrowseFox.AG
1.0.20.540

Comodo Security
TrojWare.Win32.BrowseFox.FX
21772

Dr.Web
Trojan.BPlug.979
9.0.1.05190

Emsisoft Anti-Malware
Adware.BrowseFox.AG
8.15.04.18.08

ESET NOD32
Win32/BrowseFox.AC potentially unwanted application
9.7.0.302.0

F-Prot
W32/S-a777f78c
v6.4.7.1.166

F-Secure
Adware.BrowseFox.AG
11.2015-18-04_7

G Data
Gen:Variant.Adware.SwiftBrowse
15.4.25

herdProtect (fuzzy)
variant of cantataweb.browseradapter.exe (Adware)
2015.7.19.20

K7 AntiVirus
Adware
13.202.15637

MicroWorld eScan
Adware.BrowseFox.AG
16.0.0.324

NANO AntiVirus
Riskware.Win32.Agent.dqnjuw
0.30.16.1110

nProtect
Adware.BrowseFox.AG
15.04.15.01

Reason Heuristics
PUP.Yontoo.DollarDream
15.5.3.0

Rising Antivirus
PE:Adware.SwiftBrowse!6.1A2E
23.00.65.15416

VIPRE Antivirus
Threat.4741131
38882

File size:
104.2 KB (106,736 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\dollar dream\bin\dollardream.browseradapter.exe

Digital Signature
Signed by:
Dollar Dream

Authority:
VeriSign, Inc.

Valid from:
1/14/2015 7:00:00 PM

Valid to:
1/15/2016 6:59:59 PM

Subject:
CN=Dollar Dream, O=Dollar Dream, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4F1FAD042E21F99920EB8BC152DBCEB0

File PE Metadata
Compilation timestamp:
4/17/2015 9:04:42 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:Re7leqoFduT5pNF8e2nbzuyRGv/x3ukyDxnsB25Yfw+TZo:khl9pNFKnbao+tQ02m4+O

Entry address:
0x47B5

Entry point:
E8, C5, 21, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, F3, 05, 00, 00, 3B, 0D, 70, 60, 41, 00, 75, 02, F3, C3, E9, 41, 22, 00, 00, 8B, FF, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 44, 23, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, 8A, 07, 00, 00, 59, 85, C0, 74, E6, C9, C3, F6, 05, 38, 75, 41, 00, 01, BF, 2C, 75, 41, 00, BE, 2C, 22, 41, 00, 75, 2C, 83, 0D, 38, 75, 41, 00, 01, 6A, 01, 8D, 45, FC, 50, 8B, CF, C7, 45, FC, 34, 22, 41, 00, E8, 2C, 00, 00, 00, 68, 4E, 1A, 41, 00, 89, 35, 2C...
 
[+]

Entropy:
6.3934

Code size:
67 KB (68,608 bytes)

Remove dollardream.browseradapter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.