» {blocked}.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

{blocked}.dll

SavePass

Kimahri Software inc.

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module {blocked}.dll by Kimahri Software inc has been detected as adware by 22 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0057050’. This file is typically installed with the program SavePass by Kimahri Software inc. which is a potentially unwanted software program. This is the Browser Helper Object (BHO) for the Crossrider web browser platform for Internet Explorer. Instead of utilizing a traditional IE Toolbar, it installs a BHO in the browser in order to manage the functionality of the addon. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

{blocked}.dll

Publisher:

OutBrowse (signed by Kimahri Software inc.)

Product:

SavePass

Description:

SavePass BHO

Version:

1.1.153.37

MD5:

0dc1d74fa0fe3545784ca227db785ae5

SHA-1:

3d69a18e6145c7d59bd31da74226c1f697284e8d

SHA-256:

bdcc88514c8c8c56adf9e6231a597f94ce4a0349f07289331ac09c324c8b327d

Scanner detections:

22 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Kimahri Software inc..

Analysis date:

4/25/2024 10:29:08 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Adware.Plush.1

865

Avira AntiVirus

Adware/CrossRider.A.12123

7.11.156.166

avast!

Win32:Malware-gen

2014.9-140625

AVG

MultiBundle.R

2015.0.3343

Baidu Antivirus

Adware.Win32.CrossRider

4.0.3.14625

Bitdefender

Gen:Adware.Plush.1

1.0.20.1325

Emsisoft Anti-Malware

Gen:Adware.Plush

8.14.09.22.12

ESET NOD32

Win32/Toolbar.CrossRider.AF (variant)

8.9996

Fortinet FortiGate

Riskware/Toolbar_CrossRider

9/22/2014

F-Secure

Gen:Adware.Plush.1

11.2014-22-09_2

G Data

Win32.Application.Plush

14.6.24

IKARUS anti.virus

AdWare.Plush

t3scan.1.6.1.0

Malwarebytes

PUP.Optional.SavePass.A

v2014.06.25.09

McAfee

Artemis!169FC6CD3B80

5600.6999

MicroWorld eScan

Gen:Adware.Plush.1

15.0.0.795

Panda Antivirus

PUP/PlusHD

14.06.25.09

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Reason Heuristics

PUP.Crossrider.KimahriSoftwareinc.M

14.6.25.9

Rising Antivirus

PE:Malware.Obscure!1.9C59

23.00.65.14623

Sophos

AppRider

4.98

Trend Micro House Call

TROJ_GEN.F47V0419

7.2.265

VIPRE Antivirus

Crossrider

30634

File size:

568.4 KB (581,992 bytes)

Product version:

1.1.153.37

Original file name:

SavePass.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\savepass\savepass-bho.dll

Digital Signature

Signed by:

Kimahri Software inc.

Authority:

COMODO CA Limited

Valid from:

3/7/2013 12:00:00 AM

Valid to:

3/6/2016 11:59:59 PM

Subject:

CN=Kimahri Software inc., O=Kimahri Software inc., STREET=666 Sherbrooke Rue w, L=Montreal, S=Quebec, PostalCode=H3A 1E7, C=CA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00A1BB8569950C0B2080A11A0E2F618B33

Registration

CLSIDs:

{11111111-1111-1111-1111-110511701150}, {22222222-2222-2222-2222-220522702250}

ProgIDs:

CrossriderApp0057050.BHO.1, CrossriderApp0057050.Sandbox.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

6/21/2014 10:07:05 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:bNmFr4y2VfJfIHWrQwww4/EoImTigg6WEzO6/2J:pfyh5PHTFg6jO6/2

Entry address:

0x3FDB8

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 7C, B3, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 18, B4, 07, 10, E8, B9, 30, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 08, 1D, 08, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, F0, C3, 06, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

389.5 KB (398,848 bytes)

Internet Explorer BHO

Display name:

CrossriderApp0057050

CLSID:

{11111111-1111-1111-1111-110511701150}

CLSID name:

SavePass

The file {blocked}.dll has been discovered within the following program.

SavePass by Kimahri Software inc.

SavePass is an adware web browser application that displays banner ads as well as contextual link ads that are injected in the web page.

84% remove it

Remove {blocked}.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.