home

nanosurfer.boas.dll

Nano Surfer

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module nanosurfer.boas.dll by Nano Surfer has been detected as adware by 14 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
Nano Surfer  (signed and verified)

Version:
1.0.5565.15423

MD5:
d625389830ebf430d23600b4317e456b

SHA-1:
2bdf9d07b2f1c817e709f291b2655bf02bff4563

SHA-256:
3898f57a30b2d559f73a108e3b352eefd68c0249418bc118565e302821751a05

Scanner detections:
14 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 8:23:45 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/BrowseFox.Gen7
3.6.1.96

AVG
Generic
2016.0.3156

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.15328

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Yontoo.1734
9.0.1.05190

ESET NOD32
MSIL/BrowseFox.L potentially unwanted application
7.0.302.0

F-Prot
W32/S-35d3e685
v6.4.7.1.166

IKARUS anti.virus
PUA.MSIL.BrowseFox
t3scan.1.8.9.0

K7 AntiVirus
Adware
13.202.15414

Malwarebytes
PUP.Optional.Sanbreel.A
v2015.03.28.10

NANO AntiVirus
Riskware.Win32.BPlug.djpkri
0.30.8.659

Quick Heal
Adware.Updater.A3
3.15.14.00

Reason Heuristics
PUP.Yontoo
15.3.28.22

VIPRE Antivirus
Threat.4741131
38552

File size:
3.1 MB (3,287,288 bytes)

Product version:
1.0.5565.15423

Original file name:
NanoSurfer.BOAS2015032816.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\Program Files\nano surfer\bin\plugins\nanosurfer.boas.dll

Digital Signature
Signed by:
Nano Surfer

Authority:
VeriSign, Inc.

Valid from:
12/16/2014 4:00:00 PM

Valid to:
12/17/2015 3:59:59 PM

Subject:
CN=Nano Surfer, O=Nano Surfer, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4C3408B948BFE38825B699D7ED92B282

File PE Metadata
Compilation timestamp:
3/28/2015 9:34:10 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:adxpFWsxdusW5FdpjmmXtSV1ew1LIxoFnuj0z9ny6PzHvpo2gxV3f9pX/wLbmjw9:aSdp5dSDewGoFnuj0l+txJfnUCA

Entry address:
0x322636

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.8238

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
3.1 MB (3,278,848 bytes)

Remove nanosurfer.boas.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.