» JollyWallet.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

JollyWallet.dll

JollyWallet

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module JollyWallet.dll has been detected as adware by 27 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0012555’. This file is typically installed with the program JollyWallet by Radyoos Media Ltd. which is a potentially unwanted software program. The library is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

JollyWallet.dll

Publisher:

JollyWallet

Product:

JollyWallet

Description:

JollyWallet BHO

Version:

1.1.151.38

MD5:

44ce5331220cf228c6477ae0a6138993

SHA-1:

f9d8e92a3b2e1fa6717d7608b67250f83f7f559f

SHA-256:

a98afab5cc6813c67c8946cf065ec5af864425190b0076b70e87a9db02dfbc79

Scanner detections:

27 / 68

Status:

Adware

Explanation:

May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:

4/26/2024 1:55:06 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.JollyWallet.A

974

Agnitum Outpost

Trojan.Adware

7.1.1

AhnLab V3 Security

Win-Trojan/Agent2.M.617344.H

2013.12.24

Avira AntiVirus

Adware/Vidsaver.A.12

7.11.121.112

AVG

MalSign.Skodna

2015.0.3400

Baidu Antivirus

Trojan.Win32.Toolbar

4.0.3.1465

Bitdefender

Adware.JollyWallet.A

1.0.20.780

Bkav FE

W32.Clod686.Trojan

1.3.0.4959

Comodo Security

ApplicUnwnt

17487

Emsisoft Anti-Malware

Adware.JollyWallet

8.14.06.05.05

ESET NOD32

Win32/Toolbar.CrossRider (variant)

8.9514

Fortinet FortiGate

Adware/Fam.NB

7/28/2014

F-Secure

Adware.JollyWallet.A

11.2014-05-06_5

G Data

Adware.JollyWallet

14.6.24

IKARUS anti.virus

AdWare.Win32.Vidsaver

t3scan.2.2.29

K7 AntiVirus

Trojan

13.176.11378

Malwarebytes

PUP.Optional.JollyWallet

v2014.06.05.05

McAfee

Artemis!44CE5331220C

5600.7108

Microsoft Security Essentials

Adware:Win32/Vidsaver

1.165.247.01

MicroWorld eScan

Adware.JollyWallet.A

15.0.0.468

nProtect

Adware.JollyWallet.A

14.03.07.02

Panda Antivirus

Trj/CI.A

14.07.28.01

Reason Heuristics

PUP.JollyWallet.L

14.6.5.17

Sophos

AppRider

4.96

Trend Micro House Call

TROJ_GEN.RCBCDAH

7.2.209

Trend Micro

TROJ_GEN.RCBCDAH

10.465.28

VIPRE Antivirus

Crossrider

27166

File size:

599 KB (613,376 bytes)

Product version:

1.1.151.38

Original file name:

JollyWallet.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\jollywallet\jollywallet.dll

File PE Metadata

Compilation timestamp:

10/25/2012 9:22:39 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:loJru/bPsxxzmst476G/v/hl9SNOlxe7C3t6+a3SJZE9ml1+:su/bPsxxzni6w/xSYL5tDCS7EUQ

Entry address:

0x3B78E

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 96, 9A, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, 55, C2, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, E0, 7D, 08, 10, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18... 
[+]

Entropy:

6.5870

Code size:

421 KB (431,104 bytes)

Internet Explorer BHO

Display name:

CrossriderApp0012555

CLSID:

{11111111-1111-1111-1111-110111251155}

CLSID name:

JollyWallet

The file JollyWallet.dll has been discovered within the following program.

JollyWallet by Radyoos Media Ltd.

Publisher's description - “JollyWallet is an online shopping tool that combines cash back, discounts and online coupons.”

www.jollywallet.com

76% remove it

Remove JollyWallet.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.