home

the-go-photo-it-v11-buttonutil.dll

Armageddon Labs (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module the-go-photo-it-v11-buttonutil.dll by Armageddon Labs (BrightCircle Investments Limited) has been detected as adware by 17 anti-malware scanners. The ButtonUtil module (32-bit version) uses the Crossrider web extension monetization toolkit and will perform a number of helper integration activities on the user's web browser's as well as the Window's Shell in order to install the addon. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Armageddon Labs (BrightCircle Investments Limited)  (signed and verified)

MD5:
b966b0f2adced5cb694e51b6885104b8

SHA-1:
1d3400617f4bccb7cc9f2575de3f865af4e9b528

SHA-256:
8c0fb29e7a626cecf0876ce020428de3bc911b20703ba3f58019e0952428d2ba

Scanner detections:
17 / 68

Status:
Adware

Explanation:
Part of the Crossrider toolbar platform.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application. The owner/publisher of this file is Armageddon Labs (BrightCircle Investments Limited).

Analysis date:
4/24/2024 12:40:36 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Application.Heur.Cy5@mulJbmdi
735

Avira AntiVirus
ADWARE/CrossRider.Gen7
7.11.197.84

avast!
Win32:Malware-gen
2014.9-150131

AVG
Generic
2016.0.3213

Bitdefender
Gen:Application.Heur.Cy5@mulJbmdi
1.0.20.155

ESET NOD32
Win32/Toolbar.CrossRider.BD (variant)
9.10918

Fortinet FortiGate
Riskware/CrossRider
1/31/2015

F-Secure
Gen:Application.Heur.Cy5@mulJbmdi
11.2015-31-01_7

G Data
Gen:Application.Heur.Cy5@mulJbmdi
15.1.24

Kaspersky
not-a-virus:WebToolbar.Win32.CrossRider
14.0.0.2558

McAfee
Artemis!B966B0F2ADCE
5600.6869

MicroWorld eScan
Gen:Application.Heur.Cy5@mulJbmdi
16.0.0.93

Panda Antivirus
Generic Suspicious
15.01.31.08

Reason Heuristics
Adware.Crossrider.Brightcircle
15.1.31.8

Rising Antivirus
PE:Malware.Obscure!1.9C59
23.00.65.15129

Sophos
AppRider
4.98

VIPRE Antivirus
Trojan.Win32.Generic
36008

File size:
463 KB (474,080 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\the-go-photo-it-v11\the-go-photo-it-v11-buttonutil.dll

Digital Signature
Signed by:
Armageddon Labs (BrightCircle Investments Limited)

Authority:
COMODO CA Limited

Valid from:
12/1/2014 1:00:00 AM

Valid to:
12/2/2015 12:59:59 AM

Subject:
CN=Armageddon Labs (BrightCircle Investments Limited), O=Armageddon Labs (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C5692390E715129E144F950D09DA6E8A

File PE Metadata
Compilation timestamp:
12/18/2014 1:03:13 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
6144:H7c4XlvXprotQ9Sd5QFRjtYmlSy1WCnpy8cCFg7C/FwDNqPyPkTkc3rTYnFSOaXX:H9oQHjzY2dujE3Ng+DL7rTyiB48fwfi

Entry address:
0x2EC53

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 91, 97, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 20, E4, 05, 10, E8, 0E, 36, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 48, 61, 06, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, D0, 46, 05, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Entropy:
6.3944

Developed / compiled with:
Microsoft Visual C++

Code size:
312 KB (319,488 bytes)

Remove the-go-photo-it-v11-buttonutil.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.