pacfunctionbho.dll

PacFunction

The module pacfunctionbho.dll by PacFunction has been detected as adware by 21 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘PacFunction’. This file is typically installed with the program PacFunction by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
PacFunction  (signed and verified)

Product:
PacFunction

Version:
1.0.0.3

MD5:
f9f53910bed407a5a9e19b403da7ff97

SHA-1:
99457303f90cec6439c0ec596cc3ab5df02a1391

SHA-256:
92db5ab3fcb256b9edaeb6fc6e06b7b379b5d0815ad2ef5bd660af5824719b5c

Scanner detections:
21 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
3/24/2014 2:46:09 PM UTC  (eight months ago)

Scan engine
Detection
Engine version

Antiy Labs AVL
GrayWare[AdWare:not-a-virus]/Win32.Agent
0.1.0.1

Comodo Security
Application.Win32.Altbrowse.AK
17918

Dr.Web
Trojan.BPlug.28
9.0.1.072

Emsisoft Anti-Malware
Gen:Trojan.Heur.liWfr1PcQ9lOD
8.14.03.13.04

ESET NOD32
Win32/BrowseFox (variant)
8.9533

Fortinet FortiGate
Adware/Agent
3/24/2014

Jiangmin
Adware/Agent.jaw
KV140313

K7 AntiVirus
Unwanted-Program
13.176.11524

K7 Gateway Antivirus
Unwanted-Program
13.176.11524

Kaspersky
not-a-virus:AdWare.Win32.Agent
14.0.0.4177

Kingsoft AntiVirus
Win32.Troj.Agent.ah.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.PacFunction.A
v2014.03.13.04

McAfee
Artemis!F9F53910BED4
5600.7192

McAfee Web Gateway
Artemis!F9F53910BED4
7.7192

NANO AntiVirus
Riskware.Win32.Agent.cqvnby
0.28.0.58101

Reason Heuristics
PUP.BHO.PacFunction.O
14.3.13.16

Sophos
Generic PUA JJ
4.98

SUPERAntiSpyware
Adware.BrowseFox/Variant
10708

Trend Micro House Call
TROJ_GEN.F47V0312
7.2.83

Vba32 AntiVirus
AdWare.Agent
3.12.24.3

VIPRE Antivirus
Yontoo
27288

File size:
243.8 KB (249,632 bytes)

Product version:
1.0.0.3

Copyright:
(c) PacFunction. All rights reserved.

Original file name:
PacFunctionIEClient.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\pacfunction\pacfunctionbho.dll

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
1/9/2014 1:00:00 AM

Valid to:
1/10/2015 12:59:59 AM

Subject:
CN=PacFunction, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PacFunction, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4DF47FADF68D2EB9B8A7923DCCC176FF

File PE Metadata
Compilation timestamp:
3/11/2014 12:22:16 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:aLP0F8uW/hSpAysqehClqGBZ9/svP543++EIaI+Jtuzc/L:aLP63p8qes/CgBEIaMg/L

Entry address:
0x12844

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 41, 8D, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 40, 2D, 03, 10, E8, BD, 01, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 44, 68, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 9C, A1, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

Internet Explorer BHO
Display name:
PacFunction

CLSID:
{9aa72d95-59d7-4421-a02c-f93a1187a165}


The file pacfunctionbho.dll has been discovered within the following programs.

PacFunction  by Yontoo Technology, Inc.
TiltBorwser is a Yontoo/Sambreel advertising injection adware browser extension. - Random web page text is turned into hyperlinks. - Browser popups appear which recommend fake updates or other software.
pacfunction.info/support
87% remove it
 
Powered by Should I Remove It?

There are numerous known versions of pacfunctionbho.dll by PacFunction.

37 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (aea41dafcbb17ace207b0faf0df23e7a9d93f3fc)

36 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (34bca3ef2db827ada30b175529b19f3f2b1873bf)

34 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (8d472daa32a745a1d6e65dc7e6aef6354c591b0d)

33 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (b904a6edcc5607c9968c3307e8c5574239726cd4)

33 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (c7f4b3ae8e3db9c7a2379efea8a473e91b4b86ab)

30 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (f3268547731deba19b34c7a58185edc9a7bc7b43)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (dda29df5e812dd434fc28b262e6cccedc2a7240f)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (52d024bb5944ab9a5924ed6a9dae11340db5e85c)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (837c5a89ece817fe6a1999f6de2be31722762722)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (e476e0c5892aa5dddb56b6d864e0402366ded987)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (aaf2baff42a7057182620c7b444e5759e416f523)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (7b869b5ce4f19ce3a311576048d25abd4421460a)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (5194517c31111cef7419e92f25e9122d4d1e3d2f)

29 / 68    (Adware)
pacfunctionbho.dll  1.0.0.3  (50ee77c3da9eda12a6da817ccde05248eb71a9e5)

1 / 68      (Adware)
pacfunctionbho.dll  1.0.0.3  (41717b761c1bff4380a13ada52a98e6921656813)

2 / 68      (Adware)
updatepacfunction.exe  (f4550685d9c37c849486d505a263a62fb70c203b)

1 / 68      (Adware)
PacFunction.FirstRun.exe  (0b117cdd66aa5535964629aef5de18a59a37c60a)

21 / 68    (Adware)
setup.exe  (39ad991a14dfcda4779e3ef5130b2150d4346958)

1 / 68      (Adware)
utilpacfunction.exe  (aa48919d1342d5f2f9432454be6656a7dcb446b2)

5 / 68      (Adware)
xtlsapp.exe  (ec4cca9b362aa68c66fe4ce62d3d94f8e7f9e092)

3 / 68      (Adware)
XTLS.dll  (1e5ec9d22417b7680deb6adc85ff9f918613e44b)

8 / 68      (Adware)
pacsetup.exe  (7702e38475e4e7a8b7a835fc1b518dfd3d26f1fe)

3 / 68      (Adware)
xtlsapp.dll  (fae6e47941c79b35cecd316bb1f8fa7c145cc2be)

3 / 68      (Adware)
pacfunction.browserfilter.helper.dll  (169ff578f1175c2b37af9ae5c6e2c15a3e2794e2)

1 / 68      (Adware)
PacFunctionBrowserFilter.exe  (1bfbf06188634a6b868387e8a52226d721b5e50b)

1 / 68      (Adware)
PacFunction.BrowserAdapterS.dll  (50ef051bc31513a941ca13ff4cd7d05ce8272832)

1 / 68      (Adware)
PacFunction.BrowserFilterG.dll  (d053a2f6057b54087b17fe486f68443bd5214a0b)

1 / 68      (Adware)
PacFunction.FFUpdate.dll  (2b74447d269a9d287d80b97c1e7bb71a27061c22)

19 / 68    (Adware)
pacfunction_setup.exe  (7d2c0a6c3ed67c3bb232ecb3e4c461ca350e2309)

4 / 68      (Adware)
filterapp_c.exe  (7f28667c96b4d540709e62a0de6e92f9184b9119)

1 / 68      (Adware)
wstlibg.sys  (c700b86c4da55a846e07a805b824fa0b58e575ae)

Detection Incidence by Country