home

iwebar-buttonutil.dll

Naruto Source

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module iwebar-buttonutil.dll by Naruto Source has been detected as adware by 10 anti-malware scanners. The ButtonUtil module (32-bit version) uses the Crossrider web extension monetization toolkit and will perform a number of helper integration activities on the user's web browser's as well as the Window's Shell in order to install the addon. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Naruto Source  (signed and verified)

MD5:
fb43ce129fe9c7c190a8bd39840ee821

SHA-1:
b3dd774ef237c403de4f950bd96baf346195c09e

SHA-256:
fdf549f2edef7d06ca88e466fd6774c55421a4eff37f85efb10257b56f2394f4

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Part of the Crossrider toolbar platform. Distributed through the Brightcircle investments brand.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Naruto Source.

Analysis date:
4/23/2024 8:18:31 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3345

ESET NOD32
Win32/Toolbar.CrossRider.AA (variant)
8.10276

herdProtect (fuzzy)
variant of thetorntv v10-buttonutil.dll (Adware)
2014.12.3.10

IKARUS anti.virus
not-a-virus:WebToolbar.CroRi
t3scan.1.7.5.0

Kaspersky
not-a-virus:AdWare.NSIS.Adwapper
14.0.0.3220

McAfee
Artemis!FB43CE129FE9
5600.7001

Panda Antivirus
Trj/Genetic.gen
14.09.20.09

Reason Heuristics
PUP.Crossrider.NarutoSource.R
14.9.20.21

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.14918

Sophos
AppRider
4.98

File size:
397.9 KB (407,400 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\iwebar\iwebar-buttonutil.dll

Digital Signature
Signed by:
Naruto Source

Authority:
COMODO CA Limited

Valid from:
7/27/2014 5:00:00 PM

Valid to:
7/28/2015 4:59:59 PM

Subject:
CN=Naruto Source, O=Naruto Source, STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1CE82906A7F364268F66771839675655

File PE Metadata
Compilation timestamp:
8/16/2014 3:04:06 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:rV1v7+toZjILWBTUrPSQ0vyoOTBy4BM50iQ4WZg:rfqtozTUH0v9OTA4cyZg

Entry address:
0x28133

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 9C, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 88, F9, 04, 10, E8, 0E, 36, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 48, 71, 05, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, E0, 8D, 04, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.3315

Developed / compiled with:
Microsoft Visual C++

Code size:
267 KB (273,408 bytes)

Remove iwebar-buttonutil.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.