» SearchFairy.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

SearchFairy.dll

Search Fairy

Think Tank Labs LLC

The module SearchFairy.dll, “Search Fairy for Microsoft Internet Explorer” by Think Tank Labs has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Search Fairy by Think Tank Labs, LLC which is a potentially unwanted software program.

File name:

SearchFairy.dll

Publisher:

Results Media Ltd (signed by Think Tank Labs LLC)

Product:

Search Fairy

Description:

Search Fairy for Microsoft Internet Explorer

Version:

1.2.5.0

MD5:

634697ce3b79cf84eb9e56055835445b

SHA-1:

f911b258845f836f4450173f9ac973f553ae832e

SHA-256:

e51995c2005d7cd1b52dfc5873a7baeb97baa775dc352d893eb5937eabf410f5

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/26/2024 3:07:53 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.ThinkTankLabs.ResultsMedia (M)

15.12.13.13

File size:

224.3 KB (229,712 bytes)

Product version:

1.2.5.0

Original file name:

SearchFairy.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\search fairy\searchfairy.dll

Digital Signature

Signed by:

Think Tank Labs LLC

Authority:

GoDaddy.com, Inc.

Valid from:

4/24/2012 6:26:47 PM

Valid to:

4/24/2014 6:26:47 PM

Subject:

CN=Think Tank Labs LLC, OU=Internet, O=Think Tank Labs LLC, L=Newport Beach, S=CA, C=US

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

00C784C63AD412

File PE Metadata

Compilation timestamp:

6/7/2012 10:07:01 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:VzuHO+DX7+LtREUPd9ZJpJUeAoaYuab6KFY4j0VlMSwSyV1i91RENi58ErvCwFXt:MHO+DXiJDZPxaUb6KFY1VZ9798N9wFXt

Entry address:

0x1315E

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, D2, 6F, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, C8, 44, 02, 10, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 00, 41, 02, 10, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 20, E2, 02, 10... 
[+]

Entropy:

6.4103

Code size:

138 KB (141,312 bytes)

Internet Explorer Extension

Name:

{81727BE7-50E7-48ed-A547-F0274756E2DD}

The file SearchFairy.dll has been discovered within the following program.

Search Fairy by Think Tank Labs, LLC

Search Fairy is a Results Media is a web browser extension and browser helper object (BHO) for Internet Explorer and distributed through Results Media. The Search Fairy extension includes a search bar which provides modified search redirection results and a search provider.

searchfairy.com/features.html

85% remove it

Remove SearchFairy.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.