» norpallabho.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (2)

norpallabho.dll

Norpalla

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module norpallabho.dll by Norpalla has been detected as adware by 26 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Norpalla’. Additionally, the file is typically installed by a number of programs including Norpalla by Yontoo Technology, Inc. and Buzzdock by Alactro LLC, both potentially unwanted software. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

norpallabho.dll

Publisher:

Norpalla (signed and verified)

Product:

Norpalla

Version:

1.0.0.3

MD5:

5d871c7c9ec8ec5cbd5c6fb8b3017118

SHA-1:

1d50427b7cb3ea45f81ec5943fdb590e3adc7ad8

SHA-256:

783bf725665752488759572a3321191fc9d8f56778030fd63223ed804bc3e31c

Scanner detections:

26 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/19/2024 5:53:09 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.BHO.Agent.4

920

AhnLab V3 Security

PUP/Win32.BrowseFox

2014.07.23

Avira AntiVirus

APPL/BrowseFox.Gen2

7.11.163.116

AVG

BrowseFox.F

2015.0.3398

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.14730

Bitdefender

Gen:Variant.Adware.BHO.Agent.4

1.0.20.1055

Comodo Security

Application.Win32.Altbrowse.AK

18942

Dr.Web

Trojan.BPlug.28

9.0.1.0211

Emsisoft Anti-Malware

Gen:Variant.Adware.BHO.Agent

8.14.07.30.12

ESET NOD32

Win32/BrowseFox (variant)

8.10139

Fortinet FortiGate

Adware/Agent

7/30/2014

F-Secure

Gen:Variant.Adware.BHO.Agent.4

11.2014-30-07_4

G Data

Gen:Variant.Adware.BHO.Agent

14.7.24

Kaspersky

not-a-virus:AdWare.Win32.Agent

14.0.0.3485

Malwarebytes

PUP.Optional.Norpalla.A

v2014.07.30.12

McAfee

Artemis!5D871C7C9EC8

5600.7054

MicroWorld eScan

Gen:Variant.Adware.BHO.Agent.4

15.0.0.633

NANO AntiVirus

Riskware.Win32.Agent.cuenda

0.28.2.60990

Panda Antivirus

Trj/CI.A

14.07.30.12

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Reason Heuristics

Adware.Yontoo.Norpalla.L

14.7.30.0

Sophos

Generic PUA BN

4.98

SUPERAntiSpyware

Adware.BrowseFox/Variant

10453

Trend Micro House Call

Suspicious_GEN.F47V0722

7.2.211

VIPRE Antivirus

Yontoo

31516

Zillya! Antivirus

Adware.Agent.Win32.9009

2.0.0.1859

File size:

243.8 KB (249,632 bytes)

Product version:

1.0.0.3

Original file name:

NorpallaIEClient.dll

File type:

Dynamic link library (Win32 DLL)

Common path:

C:\Program Files\norpalla\norpallabho.dll

Digital Signature

Signed by:

Norpalla

Authority:

VeriSign, Inc.

Valid from:

2/4/2014 3:00:00 AM

Valid to:

2/5/2015 2:59:59 AM

Subject:

CN=Norpalla, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Norpalla, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3CF8FDC7B1329843A9D5EE18CBB6A945

Registration

CLSID:

{18b20944-f54e-4509-88fa-f0ad137bf8de}

COM registered:

Yes

File PE Metadata

Compilation timestamp:

7/21/2014 11:05:56 AM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:C7w3txaAf0ZP0Thn+BClmD5JcM21m+26IaIlY3h/pISxd:C7w6ZQd+/ZJ6I2xBIi

Entry address:

0x12844

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 20, 2D, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 04, 68, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 7C, A1, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Entropy:

6.3665

Developed / compiled with:

Microsoft Visual C++

Code size:

159 KB (162,816 bytes)

Internet Explorer BHO

Display name:

Norpalla

CLSID:

{18b20944-f54e-4509-88fa-f0ad137bf8de}

The file norpallabho.dll has been discovered within the following programs.

Buzzdock by Alactro LLC

This is a web browser extension that injects advertising. From the EULA: "Buzzdock is free to download and use. Buzzdock is supported by advertising, and users will see additional ads on websites where Buzzdock features operate.

www.buzzdock.com/faq-support

79% remove it

Norpalla by Yontoo Technology, Inc.

This adware software (a branded version of the morphing Yontoo adware browser addon) injects itself into the user's web browser (IE, Chrome and Firefox) and will display out-of context advertising on web sites that are not associated with Yontoo or its affiliate partners.

norpalla.com/support

79% remove it

Remove norpallabho.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.