home

nanosurfer.repmon.dll

Nano Surfer

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module nanosurfer.repmon.dll by Nano Surfer has been detected as adware by 16 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
Nano Surfer  (signed and verified)

Version:
1.0.5565.15407

MD5:
3ed5a2d309ab124cf067cab23cfc77c1

SHA-1:
ec6549ebf172b10e710d93953df7a82a2630b38d

SHA-256:
1ecc29f93b8a3c46458a2edfa885641214f75535ddabac328308c340afe96c2b

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 1:21:36 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.BrowseFox
2015.03.29

Avira AntiVirus
ADWARE/BrowseFox.Gen7
3.6.1.96

AVG
Generic
2016.0.3156

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.15328

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Yontoo.1734
9.0.1.05190

ESET NOD32
MSIL/BrowseFox.L potentially unwanted application
7.0.302.0

F-Prot
W32/S-35d3e685
v6.4.7.1.166

IKARUS anti.virus
PUA.MSIL.BrowseFox
t3scan.1.8.9.0

K7 AntiVirus
Adware
13.202.15414

Malwarebytes
PUP.Optional.Sanbreel.A
v2015.03.28.10

NANO AntiVirus
Riskware.Win32.BPlug.djpkri
0.30.8.659

Quick Heal
Adware.Updater.A3
3.15.14.00

Reason Heuristics
PUP.Yontoo
15.3.28.22

VIPRE Antivirus
Threat.4741131
38552

File size:
264.7 KB (271,096 bytes)

Product version:
1.0.5565.15407

Original file name:
NanoSurfer.Repmon2015032816.dll

File type:
Dynamic link library (Win32 DLL)

Language:
Language Neutral

Common path:
C:\Program Files\nano surfer\bin\plugins\nanosurfer.repmon.dll

Digital Signature
Signed by:
Nano Surfer

Authority:
VeriSign, Inc.

Valid from:
12/16/2014 4:00:00 PM

Valid to:
12/17/2015 3:59:59 PM

Subject:
CN=Nano Surfer, O=Nano Surfer, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4C3408B948BFE38825B699D7ED92B282

File PE Metadata
Compilation timestamp:
3/28/2015 9:33:38 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:q8jx8S6F0uh5CXt2KHvAcky4PmHE2Ivs:D8S6F0uhIXkKPA5hU

Entry address:
0x42166

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.2013

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
256.5 KB (262,656 bytes)

Remove nanosurfer.repmon.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.