home

frameworkbho64.dll

Framework

App Squad

This file is a support library for an advertising-based software package (potentially unwanted/adware) distributed by 50onRed used to hijack the Internet browser search provider. The module frameworkbho64.dll by App Squad has been detected as adware by 6 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Coupon Server BHO’. This web browser addon will display additional advertisements in the user's browser including popup, banner, contextual hyperlinks as well as affiliate links.
Publisher:
App Squad  (signed and verified)

Product:
Framework

Description:
FrameworkBHO

Version:
1.1.0.0

MD5:
7272e23abf5aad1d5614e7e6e7a05c6c

SHA-1:
81ebf5f0dbab3bcfc4832a1053c6fb96f8422e9d

SHA-256:
48c2e7d1344913dd49f02b77b5f038d05ba8b092102750dc3d59c16a1c7ce119

Scanner detections:
6 / 68

Status:
Adware

Explanation:
Browser extension that injects additional advertisements (banner and text links) on web pages.

Analysis date:
4/19/2024 7:13:44 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2017.0.2835

Comodo Security
ApplicUnwnt
18281

ESET NOD32
Win64/Adware.SmartApps (variant)
10.9686

IKARUS anti.virus
AdWare.AdPlugin
t3scan.1.6.1.0

Reason Heuristics
Adware.GamePlayLabs.50OnRed (M)
16.2.12.22

VIPRE Antivirus
Win64.Adware.SmartApps
28896

File size:
481.1 KB (492,632 bytes)

Product version:
1.1.0.0

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Program Files\coupon server\frameworkbho64.dll

Digital Signature
Signed by:
App Squad

Authority:
Thawte, Inc.

Valid from:
3/18/2014 1:00:00 AM

Valid to:
3/26/2015 12:59:59 AM

Subject:
CN=App Squad, O=App Squad, L=Philadelphia, S=Pennsylvania, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
49F47D57212B012C506E1CB5CE9AF0F8

Registration
CLSIDs:
{CACB139B-7C2C-4A99-A4EE-72449D0FF549}, {F791D8AE-47E8-40A5-A913-EB2D2AF29602}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
4/21/2014 10:11:17 AM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:sOCuz6hya+1U9AlTQrU9r7V4eXvClRxoELhl/MNTvg5yvbCitL+kFBQFL1XtnMTd:AW1lyRx7hq42+iQFL1yPZ

Entry address:
0x323C8

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, B7, 93, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, FC, 04, 04, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF...
 
[+]

Code size:
284.5 KB (291,328 bytes)

Internet Explorer BHO
Display name:
Coupon Server BHO

CLSID:
{F791D8AE-47E8-40A5-A913-EB2D2AF29602}


Remove frameworkbho64.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.