» HTMLayout.dll
Overview
Analysis
File Details

HTMLayout.dll

HTMLayout

Terra Informatica Software, Inc., British Columbia, Canada.

The library HTMLayout.dll, “HTMLayout - embeddable HTML rendering and layout component” has been detected as malware by 38 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.

File name:

HTMLayout.dll

Publisher:

Terra Informatica Software, Inc., British Columbia, Canada.

Product:

HTMLayout

Description:

HTMLayout - embeddable HTML rendering and layout component

Version:

3, 3, 3, 9

MD5:

a641160277b2de144364091db4bc6412

SHA-1:

e7da5e486f07f4e7f32e5b2d84b082b6b29392a4

SHA-256:

3d00da45937fa678800ff489427cc70408bf6fc7b40aeecc9fdbba1820219be3

Scanner detections:

38 / 68

Status:

File is infected by a Virus

Explanation:

The file is infected by a polymorphic file infector virus.

Analysis date:

4/20/2024 5:11:33 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Win32.Ramnit.N

826

Agnitum Outpost

Win32.Nimnul.Gen.2

7.1.1

AhnLab V3 Security

Win32/Ramnit.J

2014.08.15

Avira AntiVirus

W32/Ramnit.C

7.11.30.172

avast!

Win32:RmnDrp

2014.9-141101

AVG

Win32/Zbot.G

2015.0.3304

Baidu Antivirus

Virus.Win32.Nimnul.$a

4.0.3.14111

Bitdefender

Win32.Ramnit.N

1.0.20.1525

Bkav FE

W32.Tmgrtext.PE

1.3.0.4959

Clam AntiVirus

W32.Ramnit-1

0.98/19280

Comodo Security

Packed.Win32.MUPX.Gen

19197

Dr.Web

Win32.Rmnet.8

9.0.1.0305

Emsisoft Anti-Malware

Win32.Ramnit.N

8.14.11.01.07

ESET NOD32

Win32/Ramnit.H virus

8.7.0.302.0

Fortinet FortiGate

W32/Ramnit.C

11/1/2014

F-Prot

W32/Ramnit.E

v6.4.6.5.141

F-Secure

Win32.Ramnit.N

11.2014-01-11_7

G Data

Win32.Ramnit

14.11.24

IKARUS anti.virus

Virus.Win32.Nimnul

t3scan.1.7.5.0

K7 AntiVirus

Virus

13.183.13054

Kaspersky

Virus.Win32.Nimnul

14.0.0.3013

Malwarebytes

Virus.Ramnit

v2014.11.01.07

McAfee

W32/Ramnit.a

5600.6960

Microsoft Security Essentials

Threat.Undefined

1.179.3048.0

MicroWorld eScan

Win32.Ramnit.N

15.0.0.915

NANO AntiVirus

Virus.Win32.Nimnul.bmnup

0.28.2.61519

nProtect

Virus/W32.SpyEye

14.08.14.01

Panda Antivirus

W32/Nimnul.A

14.11.01.07

Qihoo 360 Security

Virus.Win32.Ramnit.A

1.0.0.1015

Quick Heal

W32.Ramnit.A

11.14.14.00

Rising Antivirus

PE:Win32.Mgr.b!1594784

23.00.65.141030

Sophos

W32/Ramnit-A

4.98

Total Defense

Win32/Ramnit.C

37.0.11121

Trend Micro House Call

PE_RAMNIT.DEN

7.2.305

Trend Micro

PE_RAMNIT.DEN

10.465.01

Vba32 AntiVirus

Virus.Win32.Nimnul.b

3.12.26.3

VIPRE Antivirus

Threat.4732184

32210

ViRobot

Win32.Nimnul.A

2011.4.7.4223

File size:

1 MB (1,050,032 bytes)

Product version:

3, 3, 3, 9

Original file name:

HTMLayout.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (Canada)

Common path:

C:\Documents and Settings\{user}\Local settings\temp\htmlayout.dll

File PE Metadata

Compilation timestamp:

11/9/2011 12:20:36 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:b3nqQ3krBXVXoxwXjND3iZ8baxfSelRmMimfwoCFSkylHu8DL6y47KYuLB3KikSA:bM91XjQikAmf/T1Huc747KhgtSTEyY5

Entry address:

0x25C7C0

Entry point:

80, 7C, 24, 08, 01, 0F, 85, E2, 01, 00, 00, 60, BE, 00, B0, 17, 10, 8D, BE, 00, 60, E8, FF, 57, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46... 
[+]

Entropy:

7.5467

Code size:

904 KB (925,696 bytes)

Remove HTMLayout.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.