» Laflurla.FirstRun.exe
Overview
Analysis
File Details
Programs (1)

Laflurla.FirstRun.exe

FirstRun

Laflurla

The Yontoo branded FirstRun executable is distributed as part of a Yontoo product bundle and is desigend to install components of this ad-supported (injection) program as well as 'call home' to inform the server that the extension was installed and may request additional instructions. The application Laflurla.FirstRun.exe by Laflurla has been detected as adware by 20 anti-malware scanners. This file is typically installed with the program Laflurla by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

Laflurla (signed and verified)

Product:

FirstRun

Version:

1.0.0.0

MD5:

4b6b64c02b73c2c6392f224a56c6630e

SHA-1:

4acbe3b0947e7ad365379fa332e1c2c1eba936d0

SHA-256:

09da87aa43230a6987ba521bd0294442dbf972c3546d9d371912e386d87f6f0e

Scanner detections:

20 / 68

Status:

Adware

Explanation:

Part of the Yontoo ad injection web browser add-on.

Analysis date:

5/11/2024 12:13:26 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.BrowseFox.BM

6561816

AhnLab V3 Security

Win-PUP/BrowseFox.Gen

2015.02.28

Avira AntiVirus

ADWARE/BrowseFox.Gen

7.11.212.228

AVG

Generic

2016.0.3185

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.15227

Bitdefender

Adware.BrowseFox.BM

1.0.20.290

Emsisoft Anti-Malware

Adware.BrowseFox.BM

9.0.0.4799

ESET NOD32

MSIL/BrowseFox.D potentially unwanted application

7.0.302.0

F-Prot

W32/S-c5a74904

v6.4.7.1.166

F-Secure

Adware.BrowseFox.BM

5.13.68

G Data

Adware.BrowseFox.BM

15.2.25

K7 AntiVirus

Adware

13.1915113

Kaspersky

not-a-virus:HEUR:AdWare.MSIL.Kranet

14.0.0.2421

Malwarebytes

PUP.Optional.Sambreel.A

v2015.02.27.08

McAfee

Program.BrowseFox.a

16.8.708.2

MicroWorld eScan

Adware.BrowseFox.BM

16.0.0.174

NANO AntiVirus

Riskware.Win32.BPlug.djpkri

0.30.0.296

nProtect

Adware.BrowseFox.BM

15.02.27.01

Reason Heuristics

Adware.Yontoo.Laflurla

15.2.27.20

VIPRE Antivirus

Yontoo

29314

File size:

1.1 MB (1,121,056 bytes)

Product version:

1.0.0.0

Original file name:

Laflurla.FirstRun.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\laflurla\laflurla.firstrun.exe

Digital Signature

Signed by:

Laflurla

Authority:

VeriSign, Inc.

Valid from:

2/3/2014 4:00:00 PM

Valid to:

2/4/2015 3:59:59 PM

Subject:

CN=Laflurla, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Laflurla, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0541E25DBE69A2BC84C39AB35093A301

File PE Metadata

Compilation timestamp:

3/28/2014 8:57:20 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

24576:W6IEbTkt+Wrtb3GfwXg3+aGk1ou2X1H/xWW:W6kMctIw3aGk1qx5r

Entry address:

0x1117D6

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 10, 00, 00, 00, 20, 00, 00, 80, 18, 00, 00, 00, 2C, 03, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 38, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 50, 00, 00, 00, 5C, 20, 11, 00, D0, 02... 
[+]

Entropy:

7.9265

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

1.1 MB (1,112,064 bytes)

The file Laflurla.FirstRun.exe has been discovered within the following program.

Laflurla by Yontoo Technology, Inc.

The software injects advertisements in the user's web browser. "You are seeing Laflurla ads because you installed Laflurla on your computer. In order to keep Laflurla free, it is supported by advertisements on the websites on which it functions.

www.laflurla.com/review#ata

88% remove it

Remove Laflurla.FirstRun.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.