» GreenerWeb.FirstRun.exe
Overview
Analysis
File Details
Programs (1)

GreenerWeb.FirstRun.exe

FirstRun

Greener Web

The Yontoo branded FirstRun executable is distributed as part of a Yontoo product bundle and is desigend to install components of this ad-supported (injection) program as well as 'call home' to inform the server that the extension was installed and may request additional instructions. The application GreenerWeb.FirstRun.exe by Greener Web has been detected as adware by 25 anti-malware scanners. This file is typically installed with the program Greener Web by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

Greener Web (signed and verified)

Product:

FirstRun

Version:

1.0.0.0

MD5:

de33739279102c7fa0d067416d7d1e22

SHA-1:

cdac232b68d46a989c999539358af4b2969ca0cc

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Part of the Yontoo ad injection web browser add-on.

Analysis date:

5/8/2024 6:10:54 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.AM

387

Agnitum Outpost

Riskware.Agent

7.1.1

Avira AntiVirus

APPL/BrowseFox.Gen

7.11.156.154

avast!

Win32:BrowseFox-CG [PUP]

2014.9-160114

AVG

Greenerweb

2017.0.2865

Baidu Antivirus

Adware.MSIL.BrowseFox

4.0.3.16114

Bitdefender

Adware.SwiftBrowse.AM

1.0.20.70

Comodo Security

UnclassifiedMalware

19836

Emsisoft Anti-Malware

Adware.SwiftBrowse.AM

8.16.01.14.06

ESET NOD32

MSIL/BrowseFox (variant)

10.9992

Fortinet FortiGate

Adware/BrowseFox

1/14/2016

F-Secure

Adware.SwiftBrowse.AM

11.2016-14-01_5

G Data

Adware.SwiftBrowse.AM

16.1.24

IKARUS anti.virus

AdWare.MPlug

t3scan.1.7.5.0

K7 AntiVirus

Trojan

13.183.13198

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Kranet

14.0.0.819

Malwarebytes

PUP.Optional.Sambreel.A

v2016.01.14.06

McAfee

Artemis!92E302D00ED1

5600.6521

MicroWorld eScan

Adware.SwiftBrowse.AM

17.0.0.42

nProtect

Adware.SwiftBrowse.AM

14.10.17.01

Reason Heuristics

Adware.Yontoo.GreenerWeb (M)

16.1.14.6

Sophos

Generic PUA LG

4.98

Trend Micro House Call

Suspicious_GEN.F47V0610

7.2.14

Trend Micro

TROJ_GEN.R0C1C0PJH14

10.465.14

VIPRE Antivirus

Trojan.Win32.Generic

30608

File size:

1.1 MB (1,122,592 bytes)

Product version:

1.0.0.0

Original file name:

GreenerWeb.FirstRun.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\Program Files\greener web\greenerweb.firstrun.exe

Digital Signature

Signed by:

Greener Web

Authority:

DigiCert Inc

Valid from:

6/4/2014 6:00:00 PM

Valid to:

6/10/2015 6:00:00 AM

Subject:

CN=Greener Web, O=Greener Web, L=Santa Monica, S=California, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

07CF8E3C70EA58D06FE678225FF74862

File PE Metadata

Compilation timestamp:

6/8/2014 11:54:14 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:0Yr1XcAa+bQDsMjgL0fZGhHODUgRllQezYfku9TqVyhrHNvC3Esy434ZNlhnCV9:0YJXy+LMjZZGNQL0ZT7k4rDnC9

Entry address:

0x111D5E

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.9256

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.1 MB (1,113,600 bytes)

The file GreenerWeb.FirstRun.exe has been discovered within the following program.

Greener Web by Yontoo Technology, Inc.

This adware software (a branded version of the morphing Yontoo adware browser addon) injects itself into the user's web browser (IE, Chrome and Firefox) and will display out-of context advertising on web sites that are not associated with Yontoo or its affiliate partners.

greenerweb.info/support

80% remove it

Remove GreenerWeb.FirstRun.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.