home

steelcutbho.dll

Steel Cut

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module steelcutbho.dll by Steel Cut has been detected as adware by 27 anti-malware scanners. This file is typically installed with the program Steel Cut by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages. The file has been seen being downloaded from install-cdn.mysteelcut.com.
Publisher:
Steel Cut  (signed and verified)

Product:
Steel Cut

Version:
1.0.0.7

MD5:
d96c53b167b176eb10802adba1a75345

SHA-1:
86bd185e005c372b459ac0f98ccf9af27ce1ce3f

SHA-256:
ff3a0e3da4b1a582f8c35bb735c2c052e70074a2f481808fd70e146c57249402

Scanner detections:
27 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/24/2024 11:10:39 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
ADWARE/BrowseFox.Gen2
3.6.1.96

AVG
Generic
2016.0.3133

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.15421

Bitdefender
Gen:Variant.Mikey.11547
1.0.20.555

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.Yontoo.1016
9.0.1.0111

Emsisoft Anti-Malware
Gen:Variant.Mikey.11547
9.0.0.4799

ESET NOD32
Win32/BrowseFox.AE potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/BrowseFox
4/21/2015

F-Prot
W32/S-f64f6ec1
v6.4.7.1.166

G Data
Gen:Variant.Mikey.11547
15.4.25

herdProtect (fuzzy)
variant of steelcut.dll (Adware)
2015.7.22.13

IKARUS anti.virus
PUA.BrowseFox
t3scan.1.8.9.0

K7 AntiVirus
Trojan
13.200.15263

Malwarebytes
PUP.Optional.SteelCut.A
v2015.04.21.07

McAfee
Artemis!9B3C3F453CDB
5600.6789

NANO AntiVirus
Trojan.Win32.Yontoo.dnkubo
0.30.0.296

Qihoo 360 Security
HEUR/QVM30.1.Malware.Gen
1.0.0.1015

Reason Heuristics
Threat.Yontoo.SteelCut
15.4.21.3

Rising Antivirus
PE:Adware.BrowseFox!6.1D8B
23.00.65.15419

Sophos
Generic PUA IC
4.98

SUPERAntiSpyware
PUP.BrowseFox/Variant
9922

Trend Micro House Call
TROJ_GEN.R00UC0OCS15
7.2.111

Trend Micro
TROJ_GEN.R00UC0OCS15
10.465.21

Vba32 AntiVirus
AdWare.MSIL.Agent
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
39304

File size:
262.7 KB (269,040 bytes)

Product version:
1.0.0.7

Copyright:
(c) Steel Cut. All rights reserved.

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\steel cut\steelcutbho.dll

Digital Signature
Signed by:
Steel Cut

Authority:
VeriSign, Inc.

Valid from:
1/11/2015 10:00:00 AM

Valid to:
1/12/2016 9:59:59 AM

Subject:
CN=Steel Cut, O=Steel Cut, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0ABB826DEFFE019B3B61D91322DE992A

File PE Metadata
Compilation timestamp:
4/18/2015 7:03:11 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:b2CYUs9J7yX8LVxQbqHVOhB+PlG63Qv+iV2mZKTxRu6tmmqgcEC:b2CYUa+sLVW4VOC+1smZ20fF

Entry address:
0xF515

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, EA, 7E, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, B8, 21, 03, 10, E8, 4C, 02, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 0C, 77, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, C4, 93, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.0696

Developed / compiled with:
Microsoft Visual C++

Code size:
159 KB (162,816 bytes)

The file steelcutbho.dll has been discovered within the following program.

Steel Cut  by Yontoo Technology, Inc.
Steel Cut is an adware program that installs as a web browser plugin to inject and display advertisements.
mysteelcut.com/support
85% remove it
 
Powered by Should I Remove It?

The file steelcutbho.dll has been seen being distributed by the following URL.

http://install-cdn.mysteelcut.com/bed?r=2015041811&bet=3

Remove steelcutbho.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.