» fre_ven_s pro 23-bho64.dll
Overview
Analysis
File Details
Programs (1)

fre_ven_s pro 23-bho64.dll

Fre_Ven_s Pro 23

Kimahri Software inc.

This adware uses the Crossrider platform to build and distribute this web browser advertising injection extension. Once installed in the browser it will hijack various browser settings (homepage, search) and may interfere and track behaviors as well as deliver ads. The module fre_ven_s pro 23-bho64.dll, “Fre_Ven_s Pro 23 BHO” by Kimahri Software inc has been detected as adware by 15 anti-malware scanners. This file is typically installed with the program Fre_Ven_s Pro 23 by Kimahri Software inc. which is a potentially unwanted software program. This is the 64-bit version of the Browser Helper Object (BHO) for the Crossrider web browser platform for Internet Explorer. Instead of utilizing a traditional IE Toolbar, Crossrider installs a BHO in the browser in order to manage the functionality of setup addon. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

Publisher:

setup (signed by Kimahri Software inc.)

Product:

Fre_Ven_s Pro 23

Description:

Fre_Ven_s Pro 23 BHO

Version:

1000.1000.1000.1000

MD5:

1d86a131e79a892f9a04b7e1993f831b

SHA-1:

f59c3ce3de95fd88ab4726344ddf8b89531b6179

SHA-256:

9a9c93d85ad07412e50f9531be15114492027187efb25dad5e24b86e2c78c084

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Part of the Crossrider toolbar platform. It will run as a BHO in Internet Explorer.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Kimahri Software inc..

Analysis date:

4/25/2024 11:48:06 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

AhnLab V3 Security

Win-PUP/CrossRider

2014.12.14

Avira AntiVirus

ADWARE/CrossRider.Gen2

7.11.195.56

avast!

Win32:Crossrider-F [PUP]

141130-1

AVG

Generic

2015.0.3261

Baidu Antivirus

Adware.Win64.Crossrider

4.0.3.141213

ESET NOD32

Win64/Toolbar.Crossrider.J potentially unwanted application

7.0.302.0

G Data

Win64.Adware.Crossrider

14.12.24

Kaspersky

not-a-virus:WebToolbar.Win32.CroRi

15.0.0.543

Malwarebytes

PUP.Optional.Feven.A

v2014.12.13.12

Panda Antivirus

PUP/PlusHD

14.12.13.12

Reason Heuristics

PUP.Crossrider.KimahriSoftwareinc.W

14.12.13.12

Sophos

PUA 'AppRider' (of type Adware)

5.08

Trend Micro House Call

TROJ_GEN.R0C1C0EKE14

7.2.347

Trend Micro

TROJ_GEN.R0C1C0EKE14

10.465.13

VIPRE Antivirus

Threat.4789396

35418

File size:

716.9 KB (734,056 bytes)

Product version:

1000.1000.1000.1000

Original file name:

Fre_Ven_s Pro 23.dll

File type:

Dynamic link library (Win64 DLL)

Language:

English (United States)

Common path:

C:\Program Files\fre_ven_s pro 23\fre_ven_s pro 23-bho64.dll

Digital Signature

Signed by:

Kimahri Software inc.

Authority:

COMODO CA Limited

Valid from:

3/7/2013 2:00:00 AM

Valid to:

3/7/2016 1:59:59 AM

Subject:

CN=Kimahri Software inc., O=Kimahri Software inc., STREET=666 Sherbrooke Rue w, L=Montreal, S=Quebec, PostalCode=H3A 1E7, C=CA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00A1BB8569950C0B2080A11A0E2F618B33

Registration

CLSIDs:

{11111111-1111-1111-1111-110511801128}, {22222222-2222-2222-2222-220522802228}

ProgIDs:

CrossriderApp0058028.BHO.1, CrossriderApp0058028.Sandbox.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

6/4/2014 1:06:20 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

6144:jZxN+BZqNg6hl0ENln/IFLn0WI4+5B2h8xJg1R9hDK9Lap37f5/YTTs7XDoAmHx/:B910Yl9c5uiX3qr9JT2k

Entry address:

0x500C4

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, DF, CA, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, 70, 89, 05, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF... 
[+]

Code size:

463 KB (474,112 bytes)

The file fre_ven_s pro 23-bho64.dll has been discovered within the following program.

Fre_Ven_s Pro 23 by Kimahri Software inc.

Fre_Ven_s Pro 23 is an adware browser extension that will display banner and text-context link ads aimed to promote the installation of additional questionable content including web browser toolbars, optimization utilities and other products.

85% remove it

Remove fre_ven_s pro 23-bho64.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.