home

JollyWallet.dll

Radyoos Media Ltd.

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module JollyWallet.dll by Radyoos Media has been detected as adware by 23 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0012555’. This file is typically installed with the program JollyWallet by Radyoos Media Ltd. which is a potentially unwanted software program. This web browser addon will display additional advertisements in the user's browser including popup, banner, contextual hyperlinks as well as affiliate links.
Publisher:
JollyWallet  (signed by Radyoos Media Ltd.)

Product:
JollyWallet

Description:
JollyWallet BHO

Version:
1.1.153.72

MD5:
4f9f4b605cb70c1106461c2e9a3aff16

SHA-1:
55ac11770eea93bc2c4c750177c7726c506a1913

SHA-256:
5652d2cad0970078cb42e713023a6bbaa4e980be33433f34f1d40fd6ef8709c9

Scanner detections:
23 / 68

Status:
Adware

Explanation:
Browser extension that injects additional advertisements (banner and text links) on web pages.

Analysis date:
4/25/2024 4:02:36 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Application.Heur.Qy9@kSAIZQli
377

Avira AntiVirus
Adware/CrossRider.A.609
7.11.154.66

avast!
Win32:Installer-M [Adw]
2014.9-160123

Baidu Antivirus
Adware.Win32.CrossRider
4.0.3.16123

Bitdefender
Gen:Variant.Adware.VidSaver.1
1.0.20.115

Bkav FE
W32.Clode44.Trojan
1.3.0.4959

Comodo Security
ApplicUnwnt
18503

Emsisoft Anti-Malware
Gen:Variant.Adware.VidSaver
8.16.01.23.01

ESET NOD32
Win32/Toolbar.CrossRider (variant)
10.8629

Fortinet FortiGate
Adware/Fam.NB
1/23/2016

F-Secure
Gen:Variant.Adware.VidSaver.1
11.2016-23-01_7

G Data
Gen:Variant.Adware.VidSaver
16.1.22

IKARUS anti.virus
AdWare.Win32.CouponCompanion
t3scan.2.0.3.0

K7 AntiVirus
Trojan
13.1712358

Malwarebytes
PUP.Optional.JollyWallet
v2016.01.23.01

McAfee
Artemis!47925956B4FE
5600.6511

MicroWorld eScan
Gen:Application.Heur.Qy9@kSAIZQli
17.0.0.69

NANO AntiVirus
Riskware.Win32.CrossRider.ddopoc
0.30.0.64448

Norman
Gen:Application.Heur.Ly9@mCvLZ9gi
11.20160123

Quick Heal
Adware.CouponCompanion (Not a Virus)
1.16.14.00

Reason Heuristics
PUP.RadyoosMedia (M)
16.1.23.13

Sophos
AppRider
4.98

VIPRE Antivirus
GamePlayLabs
30168

File size:
686.1 KB (702,600 bytes)

Product version:
1.1.153.72

Copyright:
Copyright 2011

Original file name:
JollyWallet.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\jollywallet\jollywallet.dll

Digital Signature
Signed by:
Radyoos Media Ltd.

Authority:
VeriSign, Inc.

Valid from:
12/23/2012 4:00:00 PM

Valid to:
12/24/2013 3:59:59 PM

Subject:
CN=Radyoos Media Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Radyoos Media Ltd., L=Tel Aviv-Jaffa, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
49AC6CD3FC56DEFFDF28CC3D8009CFD8

Registration
CLSIDs:
{11111111-1111-1111-1111-110111251155}, {22222222-2222-2222-2222-220122252255}

ProgIDs:
CrossriderApp0012555.BHO.1, CrossriderApp0012555.Sandbox.1

COM registered:
Yes

File PE Metadata
Compilation timestamp:
2/11/2013 6:07:38 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:euU1oTd6pitTRSR50tPCD/Hac1Azj/+q06Tob17vHM06Yh+C/Q:FUSd6pitTRSD0tPCDC1zjWUTobdvlD+t

Entry address:
0x4538D

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, BF, B1, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, A2, B7, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, 90, BF, 09, 10, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18...
 
[+]

Entropy:
6.6405

Code size:
488 KB (499,712 bytes)

Internet Explorer BHO
Display name:
CrossriderApp0012555

CLSID:
{11111111-1111-1111-1111-110111251155}

CLSID name:
JollyWallet


The file JollyWallet.dll has been discovered within the following program.

JollyWallet  by Radyoos Media Ltd.
Publisher's description - “JollyWallet is an online shopping tool that combines cash back, discounts and online coupons.”
www.jollywallet.com
76% remove it
 
Powered by Should I Remove It?

Remove JollyWallet.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.