» ScanTack.PurBrowseG.dll
Overview
Analysis
File Details

ScanTack.PurBrowseG.dll

Scan Tack

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module ScanTack.PurBrowseG.dll by Scan Tack has been detected as adware by 15 anti-malware scanners. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

Publisher:

Scan Tack (signed and verified)

Version:

1.0.5319.38727

MD5:

1f76ddeed19838512776bb1a4200ac45

SHA-1:

34fcc1e86ace92023cf0ef8bd4ad67d303d4e375

SHA-256:

f8957093d778dc63eb8b504317aa748398474e9dbdc6e9c107ba4984bd91dc40

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/19/2024 12:36:19 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.Y

923

AVG

Generic

2015.0.3401

Baidu Antivirus

Adware.MSIL.BrowseFox

4.0.3.14727

Bitdefender

Adware.SwiftBrowse.Y

1.0.20.1040

Emsisoft Anti-Malware

Adware.SwiftBrowse.Y

8.14.07.27.04

ESET NOD32

MSIL/BrowseFox.G potentially unwanted application

7.0.302.0

F-Secure

Adware.SwiftBrowse.Y

11.2014-27-07_1

G Data

Adware.SwiftBrowse

14.7.24

Malwarebytes

PUP.Optional.Sanbreel.A

v2014.07.27.04

McAfee

Artemis!1F76DDEED198

5600.7057

MicroWorld eScan

Adware.SwiftBrowse.Y

15.0.0.624

nProtect

Adware.SwiftBrowse.Y

14.07.27.01

Reason Heuristics

PUP.ScanTack.S

14.7.27.3

Sophos

Generic PUA DE

4.98

VIPRE Antivirus

Threat.4741131

31208

File size:

784.8 KB (803,616 bytes)

Product version:

1.0.5319.38727

Original file name:

ScanTack.PurBrowseG.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\Program Files\scantack\bin\plugins\scantack.purbrowseg.dll

Digital Signature

Signed by:

Scan Tack

Authority:

VeriSign, Inc.

Valid from:

1/22/2014 11:00:00 AM

Valid to:

1/23/2015 10:59:59 AM

Subject:

CN=Scan Tack, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Scan Tack, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

44D91A3142283CE62B23F23C84838B0D

File PE Metadata

Compilation timestamp:

7/26/2014 8:31:08 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

12288:anMQ+7Z9OVYNbCEGk3y8WVOlnBM1xF6sESDVm6h4QeCtrNvneOETsn9zuEA8:wMQ+AVkGk3yTYRB4LJOQeSNfeXSS

Entry address:

0xC4152

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.3106

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

776.5 KB (795,136 bytes)

Remove ScanTack.PurBrowseG.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.