» {blocked}.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

{blocked}.dll

SavePass

Robokid Technologies

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module {blocked}.dll by Robokid Technologies has been detected as adware by 26 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0057050’. This file is typically installed with the program SavePass by Kimahri Software inc. which is a potentially unwanted software program. This is the Browser Helper Object (BHO) for the Crossrider web browser platform for Internet Explorer. Instead of utilizing a traditional IE Toolbar, it installs a BHO in the browser in order to manage the functionality of the addon. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.

File name:

{blocked}.dll

Publisher:

OutBrowse (signed by Robokid Technologies)

Product:

SavePass

Description:

SavePass BHO

Version:

1.1.153.43

MD5:

8681c8f2a8461fbd8d04328e1ab2fa1e

SHA-1:

60b46efa032f0a5a16b3272b3098e514096be508

SHA-256:

a44392113b805709396a9d5a7fc4b1504403429bf88287ff1f076b2056c56f41

Scanner detections:

26 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Note:

Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Robokid Technologies.

Analysis date:

5/5/2024 1:22:33 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11457336

865

Agnitum Outpost

PUA.Toolbar.CroRi

7.1.1

Avira AntiVirus

Adware/CrossRider.A.13825

7.11.157.148

AVG

Adware Generic5

2015.0.3425

Baidu Antivirus

Adware.Win32.CrossRider

4.0.3.1473

Bitdefender

Trojan.Generic.11457336

1.0.20.1325

Comodo Security

ApplicUnwnt

18849

Emsisoft Anti-Malware

Trojan.Generic.11457336

8.14.09.22.01

ESET NOD32

Win32/Toolbar.CrossRider.AF potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/CroRi

9/22/2014

F-Prot

W32/A-eb9ef301

v6.4.7.1.166

F-Secure

Trojan.Generic.11457336

11.2014-22-09_2

G Data

Trojan.Generic.11457336

14.9.24

IKARUS anti.virus

AdWare.CrossRider

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.180.12719

Kaspersky

not-a-virus:WebToolbar.Win32.CroRi

14.0.0.3212

Malwarebytes

PUP.Optional.SavePass.A

v2014.06.25.04

McAfee

Artemis!E5F5FA9F2CFF

5600.7081

MicroWorld eScan

Trojan.Generic.11457336

15.0.0.795

Panda Antivirus

Trj/Chgt.A

14.09.22.01

Qihoo 360 Security

HEUR/Malware.QVM30.Gen

1.0.0.1015

Reason Heuristics

PUP.Crossrider.BHO.M

14.7.3.1

Rising Antivirus

PE:Malware.Obscure!1.9C59

23.00.65.14623

Sophos

AppRider

4.98

Trend Micro House Call

TROJ_GEN.R092C0PG614

7.2.265

VIPRE Antivirus

Threat.4789396

29708

File size:

601 KB (615,448 bytes)

Product version:

1.1.153.43

Original file name:

SavePass.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\savepass\savepass-bho.dll

Digital Signature

Signed by:

Robokid Technologies

Authority:

COMODO CA Limited

Valid from:

6/23/2014 12:00:00 AM

Valid to:

6/23/2015 11:59:59 PM

Subject:

CN=Robokid Technologies, O=Robokid Technologies, STREET=Athinodorou 3 Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00ECF35E880AD0F3BC6F82DFB1F2E84CC0

File PE Metadata

Compilation timestamp:

6/25/2014 10:07:40 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:Dr0hAy8d/d4n/Vv7B/gtWtnxfcSHTUPps2BqbmRd:DTi/Vv+tenFcsTUWYRd

Entry address:

0x43AE8

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 7C, B3, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 08, 2E, 08, 10, E8, B9, 30, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 80, A5, 08, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, 80, 3C, 07, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

419 KB (429,056 bytes)

Internet Explorer BHO

Display name:

CrossriderApp0057050

CLSID:

{11111111-1111-1111-1111-110511701150}

CLSID name:

SavePass

The file {blocked}.dll has been discovered within the following program.

SavePass by Kimahri Software inc.

SavePass is an adware web browser application that displays banner ads as well as contextual link ads that are injected in the web page.

84% remove it

Remove {blocked}.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.