» Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
Overview
Analysis
File Details

Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll

InternetExplorerLocalPlugin

MY POP SHOP LTD

This is part of the Linkury/SnapDo monetization software, a web browser toolbar used to hijack a user's search in order to collect revenues. The SmartBar is a a potentially unwanted toolbar and Windows Gadget that is advertising supported (adware). The module Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll by MY POP SHOP has been detected as adware by 9 anti-malware scanners.

File name:

Publisher:

MY POP SHOP LTD (signed and verified)

Product:

InternetExplorerLocalPlugin

Version:

1.2.0.0

MD5:

f9eefccb39699a2597012df71c49166a

SHA-1:

3392002eba498a325687ee0669b20c1386bae994

SHA-256:

5b87f835a4aeaa972d188d9ed9f2b5f55ae45c02e5afb0280bca0c060581a5ee

Scanner detections:

9 / 68

Status:

Adware

Analysis date:

4/26/2024 9:25:10 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/Linkury.Gen2

7.11.164.128

AVG

MPomp

2015.0.3398

G Data

Win32.Application.Linkury

14.7.24

IKARUS anti.virus

PUA.Linkury

t3scan.1.6.1.0

McAfee

Artemis!7FFD7172C313

5600.7054

Panda Antivirus

PUP/LinkUry

14.07.29.07

Reason Heuristics

PUP.MYPOPSHOP.y

14.8.8.0

Trend Micro House Call

Suspicious_GEN.F47V0619

7.2.210

VIPRE Antivirus

Adware.Linkury

30674

File size:

64 KB (65,544 bytes)

Product version:

1.2.0.0

Original file name:

Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\smartbar\application\smartbar.infrastructure.plugins.internetexplorerlocalplugin.dll

Digital Signature

Signed by:

MY POP SHOP LTD

Authority:

COMODO CA Limited

Valid from:

7/6/2014 5:00:00 PM

Valid to:

7/7/2015 4:59:59 PM

Subject:

CN=MY POP SHOP LTD, O=MY POP SHOP LTD, STREET=14 Shenkar Arie, L=HERZLIYA, S=NA, PostalCode=46725, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

4A7D93FD75281A37A4ADCDCD636D3ADB

File PE Metadata

Compilation timestamp:

7/21/2014 8:36:25 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

6.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

1536:yGqAVSspUlqEwNgn4AWN1jVy/J+b+l1UJ:7UlINZo1+

Entry address:

0xFABE

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.5314

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

55 KB (56,320 bytes)

Remove Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.