» tbcore3U.dll
Overview
Analysis
File Details
Behaviors (1)

tbcore3U.dll

ShopAtHome.com IE Toolbar

ShopAtHome.com (Belcaro Group, Inc.)

The module tbcore3U.dll, “ShopAtHome.com IE Toolbar Engine” by ShopAtHome.com (Belcaro Group,) has been detected as adware by 8 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘ShopAtHome’.

File name:

tbcore3U.dll

Publisher:

ShopAtHome.com (signed by ShopAtHome.com (Belcaro Group, Inc.))

Product:

ShopAtHome.com IE Toolbar

Description:

ShopAtHome.com IE Toolbar Engine

Version:

7.0.4.10

MD5:

10d9649e327d1bdec2c5086792ee2728

SHA-1:

d50c4b6b9cd2dc0853f1aceb66c600b2cd92099a

SHA-256:

fe8058bf05902c33b1c1f6e7a7419a82c265a48d1c49a1d9a735714b152b2260

Scanner detections:

8 / 68

Status:

Adware

Explanation:

Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:

4/23/2024 9:01:41 PM UTC (today)

Scan engine

Detection

Engine version

Bitdefender

Gen:Variant.Adware.ShopAtHome.1

1.0.20.225

Emsisoft Anti-Malware

Gen:Variant.Adware.ShopAtHome

8.16.02.14.03

G Data

Gen:Variant.Adware.ShopAtHome

16.2.22

Malwarebytes

PUP.Optional.ShopAtHome.A

v2016.02.14.03

MicroWorld eScan

Gen:Variant.Adware.ShopAtHome.1

17.0.0.135

Reason Heuristics

PUP.Conduit.Toolbar.ShopAtHome.Toolbar (M)

16.2.14.3

Sophos

SAHAgent

4.98

Trend Micro House Call

Suspicious_GEN.F47V1108

7.2.45

File size:

1.8 MB (1,835,152 bytes)

Product version:

7.0.4.10

Original file name:

tbcore3U.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\roaming\shopathome\shopathometoolbar\tbcore3u.dll

Digital Signature

Signed by:

ShopAtHome.com (Belcaro Group, Inc.)

Authority:

Symantec Corporation

Valid from:

6/25/2013 8:00:00 PM

Valid to:

6/26/2014 7:59:59 PM

Subject:

CN="ShopAtHome.com (Belcaro Group, Inc.)", O="ShopAtHome.com (Belcaro Group, Inc.)", L=Greenwood Village, S=Colorado, C=US, SERIALNUMBER=19871692567, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Colorado, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:

CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

237B0D903D7BC26FE5D98F5F4AAF5E42

File PE Metadata

Compilation timestamp:

10/4/2013 1:42:29 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

49152:oCXBDFH05OzsFpSGCvH17qVDl+2jSoOZnMnmAIyJYCO:oClwDFpSGCvH17qVDlWoOZnMnmF5

Entry address:

0x10A2E2

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 80, 99, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, A0, B2, 15, 10, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, 90, A0, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, 80, A0, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85... 
[+]

Entropy:

5.7160

Code size:

1.2 MB (1,231,872 bytes)

Internet Explorer BHO

Display name:

ShopAtHome

CLSID:

{66516A07-F617-488A-90CF-4E690CFB3C5F}

CLSID name:

ShopAtHome.com Cash Back Helper

Remove tbcore3U.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.