» SavingsApp.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

SavingsApp.dll

SavingsApp

Amazing Apps

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module SavingsApp.dll by Amazing Apps has been detected as adware by 22 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0004639’. This file is typically installed with the program SavingsApp by 215 Apps which is a potentially unwanted software program. This web browser addon will display additional advertisements in the user's browser including popup, banner, contextual hyperlinks as well as affiliate links.

File name:

SavingsApp.dll

Publisher:

215 Apps (signed by Amazing Apps)

Product:

SavingsApp

Description:

SavingsApp BHO

Version:

1.1.149.11

MD5:

46e1607e6d743f6a55522fcbba003323

SHA-1:

28becfa0860db5d9f0a087b20776ac2f148146e9

SHA-256:

aa738cb91b5b0e01074eebb9ef0ec22e8c748317ecb69c53c358088172d6ce64

Scanner detections:

22 / 68

Status:

Adware

Explanation:

Browser extension that injects additional advertisements (banner and text links) on web pages.

Analysis date:

4/24/2024 9:50:23 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.VidSaver.1

1023

Avira AntiVirus

Adware/VidSaver.1.28

7.11.134.40

Bitdefender

Gen:Variant.Adware.VidSaver.1

1.0.20.535

Boost by Reason

Optional.BHO.AmazingApps.K

188838

Comodo Security

ApplicUnwnt

17866

Dr.Web

Adware.Bho.3849

9.0.1.0107

Emsisoft Anti-Malware

Gen:Variant.Adware.VidSaver

8.14.04.17.11

ESET NOD32

Win32/Toolbar.CrossRider

8.9488

F-Secure

Gen:Variant.Adware.VidSaver.1

11.2014-17-04_5

G Data

Gen:Variant.Adware.VidSaver

14.4.24

herdProtect (fuzzy)

variant of rewardsarcade.dll (Adware)

2014.7.7.0

IKARUS anti.virus

Win32.SuspectCrc

t3scan.2.2.29

K7 AntiVirus

Trojan

13.176.11302

Malwarebytes

PUP.CrossFire.SA

v2014.04.17.11

McAfee

Artemis!46E1607E6D74

5600.7157

MicroWorld eScan

Gen:Variant.Adware.VidSaver.1

15.0.0.321

Quick Heal

Adware.Crossid (Not a Virus)

4.14.12.00

Reason Heuristics

PUP.BHO.AmazingApps.K

14.8.7.17

Sophos

AppRider

4.98

Trend Micro

TROJ_GEN.R0CBC0OHR13

10.465.17

VIPRE Antivirus

GamePlayLabs

26962

ViRobot

Trojan.Win32.A.Downloader.489472.BID

2011.4.7.4223

File size:

481.9 KB (493,440 bytes)

Product version:

1.1.149.11

Original file name:

SavingsApp.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\savingsapp\savingsapp.dll

Digital Signature

Signed by:

Amazing Apps

Authority:

Thawte, Inc.

Valid from:

5/1/2012 6:00:00 AM

Valid to:

5/2/2013 5:59:59 AM

Subject:

CN=Amazing Apps, O=Amazing Apps, L=Philadelphia, S=Pennsylvania, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

2E307885017928B61D4F2CEF5EB10A05

Registration

CLSIDs:

{11111111-1111-1111-1111-110011461139}, {22222222-2222-2222-2222-220022462239}, {33333333-3333-3333-3333-330033463339}

ProgIDs:

CrossriderApp0004639.BHO.1, CrossriderApp0004639.Sandbox.1, CrossriderApp0004639.FBApi.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

3/20/2012 4:44:30 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:GjIoLRn9cLrFMiHhWtsV+6L22GjDghJ+GGYpC+73+fuFJM23s4VBkEoR:uFnWLreghWtx8XGjDOTGYpufOVBkE+

Entry address:

0x29E47

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, D8, 7D, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, A5, C5, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, 90, C4, 06, 10, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18... 
[+]

Entropy:

6.5902

Code size:

341 KB (349,184 bytes)

Internet Explorer BHO

Display name:

CrossriderApp0004639

CLSID:

{11111111-1111-1111-1111-110011461139}

CLSID name:

SavingsApp

The file SavingsApp.dll has been discovered within the following program.

SavingsApp by 215 Apps

215 SavingsApp (by 50onRed) is a web browser plugin that displays coupon deals and other advertisements when users visit various online shopping sites.

savings-app.com

86% remove it

Remove SavingsApp.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.