» GreenerWeb.FirstRun.exe
Overview
Analysis
File Details
Programs (1)

GreenerWeb.FirstRun.exe

FirstRun

Greener Web

The Yontoo branded FirstRun executable is distributed as part of a Yontoo product bundle and is desigend to install components of this ad-supported (injection) program as well as 'call home' to inform the server that the extension was installed and may request additional instructions. The application GreenerWeb.FirstRun.exe by Greener Web has been detected as adware by 25 anti-malware scanners. This file is typically installed with the program Greener Web by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

Greener Web (signed and verified)

Product:

FirstRun

Version:

1.0.0.0

MD5:

250669a19ece9edc656e3496e7e7d8ce

SHA-1:

434b1a7169c29b927795a8e16267db0ea6e02994

SHA-256:

ee72d6cf1097ddd67eee25077231f9004c5d55894f907b231dfc8a8c80a3c548

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Part of the Yontoo ad injection web browser add-on.

Analysis date:

4/25/2024 7:43:00 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.AM

382

Agnitum Outpost

Riskware.Agent

7.1.1

Avira AntiVirus

APPL/BrowseFox.Gen

7.11.156.154

avast!

Win32:BrowseFox-CG [PUP]

2014.9-160118

AVG

Greenerweb

2017.0.2860

Baidu Antivirus

Adware.MSIL.BrowseFox

4.0.3.16118

Bitdefender

Adware.SwiftBrowse.AM

1.0.20.90

Comodo Security

UnclassifiedMalware

19836

Emsisoft Anti-Malware

Adware.SwiftBrowse.AM

8.16.01.18.11

ESET NOD32

MSIL/BrowseFox (variant)

10.9992

Fortinet FortiGate

Adware/BrowseFox

1/18/2016

F-Secure

Adware.SwiftBrowse.AM

11.2016-18-01_2

G Data

Adware.SwiftBrowse.AM

16.1.24

IKARUS anti.virus

AdWare.MPlug

t3scan.1.7.5.0

K7 AntiVirus

Trojan

13.183.13198

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Kranet

14.0.0.795

Malwarebytes

PUP.Optional.Sambreel.A

v2016.01.18.11

McAfee

Artemis!92E302D00ED1

5600.6516

MicroWorld eScan

Adware.SwiftBrowse.AM

17.0.0.54

nProtect

Adware.SwiftBrowse.AM

14.10.17.01

Reason Heuristics

Adware.Yontoo.GreenerWeb (M)

16.1.18.23

Sophos

Generic PUA LG

4.98

Trend Micro House Call

Suspicious_GEN.F47V0610

7.2.18

Trend Micro

TROJ_GEN.R0C1C0PJH14

10.465.18

VIPRE Antivirus

Trojan.Win32.Generic

30608

File size:

1.1 MB (1,122,592 bytes)

Product version:

1.0.0.0

Original file name:

GreenerWeb.FirstRun.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\greener web\greenerweb.firstrun.exe

Digital Signature

Signed by:

Greener Web

Authority:

DigiCert Inc

Valid from:

6/5/2014 1:00:00 AM

Valid to:

6/10/2015 1:00:00 PM

Subject:

CN=Greener Web, O=Greener Web, L=Santa Monica, S=California, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

07CF8E3C70EA58D06FE678225FF74862

File PE Metadata

Compilation timestamp:

6/6/2014 2:53:48 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:QsZ8zcGr/3mIB/yAosnAUh8KJERjgcdabEokdhyhdp:QsKzp/2IQAosnrYWIo/p

Entry address:

0x111D4A

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.1 MB (1,113,600 bytes)

The file GreenerWeb.FirstRun.exe has been discovered within the following program.

Greener Web by Yontoo Technology, Inc.

This adware software (a branded version of the morphing Yontoo adware browser addon) injects itself into the user's web browser (IE, Chrome and Firefox) and will display out-of context advertising on web sites that are not associated with Yontoo or its affiliate partners.

greenerweb.info/support

80% remove it

Remove GreenerWeb.FirstRun.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.