home

{eaabe688-7958-4e60-9b69-e12261cee876}gw64.sys

ViewPlay

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The file {eaabe688-7958-4e60-9b69-e12261cee876}gw64.sys by ViewPlay has been detected as adware by 18 anti-malware scanners. It runs as a Windows 64-bit kernel mode device driver named “{eaabe688-7958-4e60-9b69-e12261cee876}Gw64”. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
StdLib  (signed by ViewPlay)

Product:
StdLib

Version:
1.4.4.6 built by: WinDDK

MD5:
a9ce8a113acfbdb3494cf844b8b24185

SHA-1:
32b3a7198fae1f71a1fac80139c85dfe4f15d6b6

SHA-256:
d80271cc62a10a23ec8652933192d6b0b439464ac547fd4385d2c3697d0569bd

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 7:46:30 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.SwiftBrowse.CH
356

Agnitum Outpost
Riskware.Agent
7.1.1

AVG
Generic
2017.0.2834

Bitdefender
Adware.SwiftBrowse.CH
1.0.20.220

Clam AntiVirus
Win.Adware.Swiftbrowse-497
0.98/21411

Emsisoft Anti-Malware
Adware.SwiftBrowse.CH
8.16.02.13.09

ESET NOD32
Win64/BrowseFox.CG (variant)
10.10676

Fortinet FortiGate
Adware/BrowseFox
2/13/2016

F-Prot
W64/A-bd57be8c
v6.4.7.1.166

F-Secure
Adware.SwiftBrowse.CH
11.2016-13-02_7

G Data
Adware.SwiftBrowse.CH
16.2.24

McAfee
Artemis!3C51AD12EBE9
5600.6490

MicroWorld eScan
Adware.SwiftBrowse.CH
17.0.0.132

Norman
Adware.SwiftBrowse.CH
11.20160213

nProtect
Adware.SwiftBrowse.CH
14.11.05.01

Reason Heuristics
PUP.Yontoo.ViewPlay (M)
16.2.13.21

VIPRE Antivirus
Trojan.Win32.Generic
34538

Zillya! Antivirus
Adware.Yotoon.Win64.14
2.0.0.1976

File size:
47.7 KB (48,824 bytes)

Product version:
1.4.4.6

Copyright:
Copyright © 2013 StdLib

Original file name:
StdLib.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\{eaabe688-7958-4e60-9b69-e12261cee876}gw64.sys

Digital Signature
Signed by:
ViewPlay

Authority:
VeriSign, Inc.

Valid from:
11/26/2013 6:00:00 PM

Valid to:
11/27/2014 5:59:59 PM

Subject:
CN=ViewPlay, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ViewPlay, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0F9F45EC13C318E3C0F42DA156EA0A92

File PE Metadata
Compilation timestamp:
9/22/2014 2:01:54 PM

OS version:
6.1

OS bitness:
Win64

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
768:lk7G2EjsnyXeOUEGG0LA8tWFZuL470h6aqxcCT2kvsVRwlZD3Eg5Hz:OFID6EGnLA8AFJTNEVmDEmHz

Entry address:
0xC064

Entry point:
48, 83, EC, 28, 4C, 8B, C2, 4C, 8B, C9, E8, 95, FF, FF, FF, 49, 8B, D0, 49, 8B, C9, 48, 83, C4, 28, E9, E2, 50, FF, FF, CC, CC, 78, C2, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 54, C6, 00, 00, A0, 91, 00, 00, 28, C1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, DA, CA, 00, 00, 50, 90, 00, 00, D8, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, D2, CB, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B6, CB, 00, 00, 00, 00, 00, 00, A2, CB, 00, 00...
 
[+]

Entropy:
6.3932

Code size:
34.5 KB (35,328 bytes)

Driver
Display name:
{eaabe688-7958-4e60-9b69-e12261cee876}Gw64

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.