home

eduapp.browseradapter.exe

Edu App

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application eduapp.browseradapter.exe by Edu App has been detected as adware by 22 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
Edu App  (signed and verified)

MD5:
21669a6a38e868ef154659f5b5d53e06

SHA-1:
4dcb3f60c63336f8a8c32c0ca80441aa5077ce99

SHA-256:
bc66c28b2934dfd3d537d87f16e74c8060e99a66cc054e7d2edefc2783bee936

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
5/9/2024 3:58:56 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.BB
547

Agnitum Outpost
Trojan.Yontoo
7.1.1

AhnLab V3 Security
PUP/Win32.BrowseFox
2015.05.10

avast!
Win32:BrowseFox-HQ [PUP]
2014.9-150807

AVG
Adware AdPlugin
2016.0.3114

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.1559

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Swiftbrowse-1369
0.98/20464

Dr.Web
Trojan.Yontoo.1734
9.0.1.0129

Emsisoft Anti-Malware
Adware.BrowseFox.BB
8.15.08.07.06

ESET NOD32
Win32/BrowseFox.AX potentially unwanted
9.11600

F-Prot
W32/S-a777f78c
v6.4.7.1.166

herdProtect (fuzzy)
variant of secretsauce.browseradapter.exe (Adware)
2015.8.7.6

K7 AntiVirus
Adware
13.203.15857

MicroWorld eScan
Adware.BrowseFox.BB
16.0.0.657

NANO AntiVirus
Trojan.Win32.Yontoo.dqyaqf
0.30.24.1357

nProtect
Adware.BrowseFox.BB
15.05.15.01

Quick Heal
PUA.Secretsauc.Gen
8.15.14.00

Reason Heuristics
PUP.Yontoo.EduApp
15.5.14.18

Rising Antivirus
PE:Adware.SwiftBrowse!6.1A2E
23.00.65.15507

VIPRE Antivirus
Threat.4741131
39486

Zillya! Antivirus
Adware.Agent.Win32.56110
2.0.0.2173

File size:
105.7 KB (108,264 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\edu app\bin\eduapp.browseradapter.exe

Digital Signature
Signed by:
Edu App

Authority:
VeriSign, Inc.

Valid from:
3/18/2015 8:00:00 AM

Valid to:
3/18/2016 7:59:59 AM

Subject:
CN=Edu App, O=Edu App, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2A116E4DDAE4EB2C28F70FBC481D3E94

File PE Metadata
Compilation timestamp:
5/9/2015 11:42:45 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:vkia8A7QPno105F3emHt7bu26Gf3p/ekGVn8Bxbc+iW10:vkia85W05FLN7yDOVxxbc+iW2

Entry address:
0x4BD5

Entry point:
E8, D5, 21, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 03, 06, 00, 00, 3B, 0D, 70, 60, 41, 00, 75, 02, F3, C3, E9, 51, 22, 00, 00, 8B, FF, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 54, 23, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, 9A, 07, 00, 00, 59, 85, C0, 74, E6, C9, C3, F6, 05, 38, 75, 41, 00, 01, BF, 2C, 75, 41, 00, BE, 5C, 22, 41, 00, 75, 2C, 83, 0D, 38, 75, 41, 00, 01, 6A, 01, 8D, 45, FC, 50, 8B, CF, C7, 45, FC, 64, 22, 41, 00, E8, 2C, 00, 00, 00, 68, 7E, 1E, 41, 00, 89, 35, 2C...
 
[+]

Entropy:
6.4023

Code size:
68 KB (69,632 bytes)

Remove eduapp.browseradapter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.