home

GreyGrayBrowserFilter.exe

GreyGray

Installed as part of the Yontoo GreyGray branded web browser extension, the BrowserFilter component is responsible for injecting advertising in the browser based on the context of the HTML being rendered. Ads are injected in the browser in the form of inline text, coupons, multi-site searching and additional offers. The application GreyGrayBrowserFilter.exe by GreyGray has been detected as adware by 10 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
GreyGray  (signed and verified)

Version:
0.0.0.0

MD5:
5cffc27bb4e53bfdc6406d893fed44c5

SHA-1:
52f114b426276084e421579f6390525bf01c4fcc

SHA-256:
2207c99accc9f2bd7db7366584768e9fe476be2d86aa8bc9c95872534195dd70

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Part of the Yontoo ad injection web browser add-on.

Analysis date:
4/25/2024 1:40:48 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/BrowseFox.Gen7
7.11.189.64

AVG
GreyGray
2015.0.3277

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.141128

ESET NOD32
MSIL/BrowseFox.I potentially unwanted application
7.0.302.0

IKARUS anti.virus
not-a-virus:AdWare.SwiftBrowse
t3scan.1.8.3.0

Malwarebytes
PUP.Optional.Sanbreel.A
v2014.11.28.01

McAfee
BrowseFox-SJ
5600.6933

Reason Heuristics
PUP.GreyGray.V
14.11.28.0

Sophos
GreyGray
4.98

VIPRE Antivirus
Threat.4741131
35088

File size:
35.3 KB (36,120 bytes)

Product version:
0.0.0.0

Original file name:
GreyGrayBrowserFilter.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\greygray\bin\greygraybrowserfilter.exe

Digital Signature
Signed by:
GreyGray

Authority:
VeriSign, Inc.

Valid from:
9/19/2013 5:00:00 AM

Valid to:
9/20/2015 4:59:59 AM

Subject:
CN=GreyGray, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=GreyGray, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
23FF62A16C638B371A4AB98A8F876E8B

File PE Metadata
Compilation timestamp:
11/28/2014 12:46:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:AZtTcj//htvbO64yCio8H8WQbS3NINRQ9CINqvLMn0:AZOjnhtvKx1io8HvIRoCIYDR

Entry address:
0x88A6

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 6E, 00, 00, 00, E8, 88, 00, 00, E8, 6A, 00, 00, 52, 53, 44, 53, 5B, F8, 02, 98, 7F, 92, 1D, 4F, AB, E0, 30, 75, 9A, A6, 93, E2, 01, 00, 00, 00, 44, 3A, 5C, 55, 74, 69, 6C, 69, 74, 69, 65, 73, 5C, 71, 6C, 31, 64, 32, 6D, 6A, 6A, 2E, 78, 6D, 65, 5C, 44, 65, 73, 6B, 74, 6F, 70, 5C, 42, 72, 6F, 77...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
26.5 KB (27,136 bytes)

Remove GreyGrayBrowserFilter.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.