home

kingbrowsebho.dll

KingBrowse

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module kingbrowsebho.dll by KingBrowse has been detected as adware by 19 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘KingBrowse’. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
KingBrowse  (signed and verified)

Product:
KingBrowse

Version:
1.0.0.3

MD5:
71b7b5705caa14208b9cc85745725869

SHA-1:
7b503f2f425009d5fd9e2fd119af18dc0d405997

SHA-256:
88ed2578b8979c59e99d378ebb492cde6d906cb6cd6e35c11262cad0e95861fc

Scanner detections:
19 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 9:26:39 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.SwiftBrowse.E
896

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
Adware/Win32.BHO
2014.08.23

Avira AntiVirus
APPL/BrowseFox.Gen2
7.11.168.230

AVG
Adware BrowseFox.F
2014.0.3986

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.14822

Bitdefender
Adware.SwiftBrowse.E
1.0.20.1170

Dr.Web
Trojan.BPlug.141
9.0.1.05190

Emsisoft Anti-Malware
Adware.SwiftBrowse
8.14.08.22.07

ESET NOD32
Win32/BrowseFox.O potentially unwanted application
7.0.302.0

F-Secure
Adware.SwiftBrowse.E
11.2014-22-08_6

G Data
Adware.SwiftBrowse
14.8.24

IKARUS anti.virus
AdWare.BrowseFox
t3scan.1.7.5.0

Malwarebytes
PUP.Optional.KingBrowse.A
v2014.08.22.07

MicroWorld eScan
Adware.SwiftBrowse.E
15.0.0.702

nProtect
Adware.SwiftBrowse.E
14.08.22.01

Reason Heuristics
Adware.Yontoo.KingBrowse.N
14.8.22.18

VIPRE Antivirus
Threat.4741131
32210

Zillya! Antivirus
Backdoor.PePatch.Win32.39529
2.0.0.1899

File size:
244.3 KB (250,144 bytes)

Product version:
1.0.0.3

Copyright:
(c) KingBrowse. All rights reserved.

Original file name:
KingBrowseIEClient.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\kingbrowse\kingbrowsebho.dll

Digital Signature
Signed by:
KingBrowse

Authority:
VeriSign, Inc.

Valid from:
1/9/2014 1:00:00 AM

Valid to:
1/10/2015 12:59:59 AM

Subject:
CN=KingBrowse, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=KingBrowse, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
670CAB2C338090653CEA8172D5DB1E34

Registration
CLSID:
{a5915ec9-2613-45fc-931c-229a142d396c}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
8/21/2014 9:35:39 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:WdJoBzQQExkBagz/SkFP9XKduTTci+0IaIF0hpvJcl:W6zQQExmay/S0TI6nvJu

Entry address:
0x12854

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 80, 30, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 24, 78, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 0C, A5, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

Internet Explorer BHO
Display name:
KingBrowse

CLSID:
{a5915ec9-2613-45fc-931c-229a142d396c}


Remove kingbrowsebho.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.