home

hna.dll

OPEN.co., ltd

The module hna.dll by OPEN.co., ltd has been detected as adware by 10 anti-malware scanners.
Publisher:
OPEN.co., ltd  (signed and verified)

MD5:
faded2b68e474118e9319f05f520bc04

SHA-1:
7828c12f29540972cc1ed2b663132b6bc67ab5cc

SHA-256:
466e873de7c6150ab47bf39bb8a643de94c2d0d080e85e7738a7715ee2ac09ab

Scanner detections:
10 / 68

Status:
Adware

Analysis date:
4/19/2024 8:54:10 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.PowerSearch
2015.03.07

avast!
Win32:Adware-AZE [Adw]
2014.9-150904

AVG
Generic5
2016.0.2997

Dr.Web
BackDoor.Infector.133
9.0.1.0247

McAfee
Artemis!FADED2B68E47
5600.6653

Qihoo 360 Security
Win32/Trojan.Adware.37e
1.0.0.1015

Reason Heuristics
PUP.OPENco (M)
15.9.4.7

Sophos
Generic PUA HI
4.98

VIPRE Antivirus
Trojan.Win32.Generic
38190

ViRobot
Adware.Agent.675864[h]
2014.3.20.0

File size:
660 KB (675,864 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\users\{user}\appdata\roaming\iesearchtool\hna.dll

Digital Signature
Signed by:
OPEN.co., ltd

Authority:
Thawte, Inc.

Valid from:
12/24/2012 9:00:00 AM

Valid to:
2/23/2015 8:59:59 AM

Subject:
CN="OPEN.co., ltd", O="OPEN.co., ltd", L="Gangnam-gu,", S=Seoul, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
548AAD77F8523322625F42520037EA48

File PE Metadata
Compilation timestamp:
3/25/2014 9:30:05 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:Vc5zGCqvy3sVm9770frc+1sV7E2unpe2g4WmQN9pr1FQ+Rqm6nMi:LCHsVI77aT1sVHik2g4WmQN9fa+RCMi

Entry address:
0x8DB74

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, B8, FC, C5, 48, 00, E8, 3D, 92, F7, FF, 33, C0, 55, 68, A3, DC, 48, 00, 64, FF, 30, 64, 89, 20, B2, 01, A1, 7C, 48, 42, 00, E8, DB, 6D, F9, FF, 8B, D8, BA, 01, 00, 00, 80, 8B, C3, E8, 6D, 6E, F9, FF, 33, C9, BA, C0, DC, 48, 00, 8B, C3, E8, C3, 6E, F9, FF, 84, C0, 75, 1A, BA, 02, 00, 00, 80, 8B, C3, E8, 4F, 6E, F9, FF, 33, C9, BA, C0, DC, 48, 00, 8B, C3, E8, A5, 6E, F9, FF, BA, E0, DC, 48, 00, 8B, C3, E8, B5, 73, F9, FF, 84, C0, 0F, 85, A3, 00, 00, 00, 83, 7B, 10, 00, 74...
 
[+]

Entropy:
6.6210

Developed / compiled with:
Microsoft Visual C++

Code size:
562 KB (575,488 bytes)

Remove hna.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.