home

{e4c6227e-782d-4fb9-9a91-19df3596a980}.dll

XVRNT

Rolimno

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module {e4c6227e-782d-4fb9-9a91-19df3596a980}.dll, “TODO: <File description>” by Rolimno has been detected as adware by 31 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
TODO: <Company name>  (signed by Rolimno)

Product:
XVRNT

Description:
TODO: <File description>

Version:
2.1.0.2

MD5:
c7ec69a3d5d7b311bdf4c25a14a69bfe

SHA-1:
cca1ac3e8e5655eb47bffdfb990fbbffbbaab353

SHA-256:
c382ae601ea65018276e5dd4b8e2a94a83c9b29951de6c01206b10d8bae4e823

Scanner detections:
31 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/19/2024 1:04:55 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.BR
363

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.BrowseFox
2015.01.25

Avira AntiVirus
ADWARE/BrowseFox.Gen
7.11.204.248

avast!
Win32:BrowseFox-C [PUP]
2014.9-160206

AVG
Rolimno
2017.0.2841

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.1626

Bitdefender
Adware.BrowseFox.BR
1.0.20.185

Clam AntiVirus
Win.Adware.Mplug-43
0.98/19972

Dr.Web
Trojan.BPlug.214
9.0.1.037

Emsisoft Anti-Malware
Adware.BrowseFox.BR
8.16.02.06.06

ESET NOD32
Win32/BrowseFox.M potentially unwanted application
10.7.0.302.0

F-Prot
W32/A-d34eca05
v6.4.7.1.166

F-Secure
Adware.BrowseFox.BR
11.2016-06-02_7

G Data
Adware.BrowseFox.BR
16.2.24

IKARUS anti.virus
not-a-virus:AdWare.Win32.Agent
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.192.14744

Kaspersky
not-a-virus:AdWare.Win32.SwiftBrowse
14.0.0.701

Malwarebytes
Adware.SwiftBrowse
v2016.02.06.06

McAfee
Program.BrowseFox
5600.6497

MicroWorld eScan
Adware.BrowseFox.BR
17.0.0.111

NANO AntiVirus
Trojan.Win32.BPlug.decyqf
0.30.0.64812

nProtect
Adware.BrowseFox.BR
15.01.23.01

Quick Heal
Adware.Yotoon.A6
2.16.14.00

Reason Heuristics
PUP.Yontoo.Rolimno (M)
16.2.6.18

Sophos
PUA 'Browse Fox'
59

Trend Micro House Call
TROJ_GEN.R0C1C0EJD14
7.2.37

Trend Micro
TROJ_GEN.R0C1C0EJD14
10.465.06

Vba32 AntiVirus
AdWare.Agent
3.12.26.3

VIPRE Antivirus
Threat.4150696
36666

Zillya! Antivirus
Backdoor.PePatch.Win32.42822
2.0.0.2044

File size:
289.3 KB (296,216 bytes)

Product version:
2.1.0.2

Copyright:
TODO: (c) <Company name>. All rights reserved.

Original file name:
XTLS.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\rolimno\bin\{e4c6227e-782d-4fb9-9a91-19df3596a980}.dll

Digital Signature
Signed by:
Rolimno

Authority:
VeriSign, Inc.

Valid from:
8/12/2013 7:00:00 PM

Valid to:
8/13/2015 6:59:59 PM

Subject:
CN=Rolimno, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Rolimno, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0D2645238961D2084208FC4B5B89E7FD

File PE Metadata
Compilation timestamp:
4/30/2014 6:20:28 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:WMIwkOaVc3OotsrAEM2kVUFxXYNO0A/LKJeeJnXVL2TjXOCbq2xqoIfTean8S75t:WMIwk72laQGW/spGXV2GCbqZoIfhVHh1

Entry address:
0x21C37

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, CB, 84, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, B8, 57, AC, 02, 10, A3, 88, 23, 04, 10, C7, 05, 8C, 23, 04, 10, 4D, A3, 02, 10, C7, 05, 90, 23, 04, 10, 01, A3, 02, 10, C7, 05, 94, 23, 04, 10, 3A, A3, 02, 10, C7, 05, 98, 23, 04, 10, A3, A2, 02, 10, A3, 9C, 23, 04, 10, C7, 05, A0, 23, 04, 10, CF, AB, 02, 10, C7, 05, A4, 23, 04, 10, BF, A2, 02, 10, C7, 05, A8, 23, 04, 10, 21, A2, 02, 10, C7, 05, AC, 23, 04, 10, AD, A1...
 
[+]

Entropy:
6.5056

Code size:
204 KB (208,896 bytes)

Remove {e4c6227e-782d-4fb9-9a91-19df3596a980}.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.