home

updatelaflurla.exe

Laflurla

Part of the Yontoo web browser plugin (delivers advertisements to the web browser in the form of injected banners, text-links, popups, etc.) the updater mechanism for Laflurla will automatically keep the extension patched by downloaded new functionality which is auto-enabled by default. The application updatelaflurla.exe by Laflurla has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update Laflurla”. This file is typically installed with the program Laflurla by Yontoo Technology, Inc. which is a potentially unwanted software program.
Publisher:
Laflurla  (signed and verified)

Version:
1.0.5393.16400

MD5:
59e36e2755b568f116bff4060d2a7e43

SHA-1:
704bfdf786e684c97d3a14fec0c358aed094e3b2

SHA-256:
1e5005f3cb7440f1334312623c2da42150f360e14123b691275aa8c5a527e78d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Part of the Yontoo adware web browser extension update process.

Analysis date:
4/26/2024 12:00:24 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Yontoo.Laflurla (M)
16.2.13.0

File size:
510.3 KB (522,528 bytes)

Product version:
1.0.5393.16400

Original file name:
Laflurla.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\laflurla\updatelaflurla.exe

Digital Signature
Signed by:
Laflurla

Authority:
VeriSign, Inc.

Valid from:
2/3/2014 4:00:00 PM

Valid to:
2/4/2015 3:59:59 PM

Subject:
CN=Laflurla, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Laflurla, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0541E25DBE69A2BC84C39AB35093A301

File PE Metadata
Compilation timestamp:
10/7/2014 10:06:45 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:eM2ft22lgr8DnTDrLF2Tx+xR9fyO2hm+9YoDJFvlh6UXonQf/IwXu8+a/XbUqwHf:eMEf/B4x+xRUhJxIweUfb+H5bgqJwUV

Entry address:
0x7F3A6

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 5B, 00, 00, 00, E8, F3, 07, 00, E8, D5, 07, 00, 52, 53, 44, 53, 47, AA, 0E, F0, 8D, BE, 7B, 41, 81, D8, 54, 07, 0B, 79, A1, 14, 01, 00, 00, 00, 44, 3A, 5C, 55, 74, 69, 6C, 69, 74, 69, 65, 73, 5C, 7A, 32, 6D, 77, 72, 6B, 77, 76, 2E, 30, 75, 32, 5C, 44, 65, 73, 6B, 74, 6F, 70, 5C, 44, 65, 73, 6B...
 
[+]

Entropy:
5.9295

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
501.5 KB (513,536 bytes)

Service
Display name:
Update Laflurla

Type:
Win32OwnProcess


The file updatelaflurla.exe has been discovered within the following program.

Laflurla  by Yontoo Technology, Inc.
The software injects advertisements in the user's web browser. "You are seeing Laflurla ads because you installed Laflurla on your computer. In order to keep Laflurla free, it is supported by advertisements on the websites on which it functions.
www.laflurla.com/review#ata
88% remove it
 
Powered by Should I Remove It?

Remove updatelaflurla.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.