utilholdpage.exe

middle pages

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application utilholdpage.exe by middle pages has been detected as adware by 19 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “Update Hold Page”. This file is typically installed with the program Hold Page by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
middle pages  (signed and verified)

Version:
1.0.5485.4283

MD5:
1a54bb54394358c5b77c5bc2b28bdca0

SHA-1:
35281f28081838d95683f5719cf8dd86c715631d

SHA-256:
37ac490da67fa07c9dee45a8aeb8eddf79eb1eaa480198dd43d5cebef99b0381

Scanner detections:
19 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/18/2024 1:31:59 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.BrowseFox.AL
736

Avira AntiVirus
ADWARE/BrowseFox.Gen7
7.11.199.252

AVG
Generic
2016.0.3214

Baidu Antivirus
Adware.MSIL.BrowseFox
4.0.3.15130

Bitdefender
Adware.BrowseFox.AL
1.0.20.150

Emsisoft Anti-Malware
Adware.BrowseFox.AL
8.15.01.30.11

ESET NOD32
MSIL/BrowseFox (variant)
9.10978

F-Secure
Adware.BrowseFox.AL
11.2015-30-01_6

G Data
Adware.BrowseFox.AL
15.1.24

K7 AntiVirus
Adware
13.1814571

Malwarebytes
PUP.Optional.HoldPage.A
v2015.01.30.11

McAfee
Artemis!1A54BB543943
5600.6870

MicroWorld eScan
Adware.BrowseFox.AL
16.0.0.90

nProtect
Adware.BrowseFox.AL
15.01.07.01

Qihoo 360 Security
Win32/Virus.Adware.708
1.0.0.1015

Reason Heuristics
PUP.Service.Yontoo
15.1.30.11

Sophos
Generic PUA DF
4.98

Trend Micro House Call
Suspicious_GEN.F47V0107
7.2.30

VIPRE Antivirus
Yontoo
36456

File size:
516.7 KB (529,136 bytes)

Product version:
1.0.5485.4283

Original file name:
HoldPage2015010710.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\hold page\bin\utilholdpage.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
10/6/2014 6:00:00 PM

Valid to:
10/2/2015 5:59:59 PM

Subject:
CN=middle pages, O=middle pages, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
01FD540333A96486522A2EDFD3C2E0B3

File PE Metadata
Compilation timestamp:
1/7/2015 4:22:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:ikCgsF55xG5iW0fpPF9UIqMPQbuctAsNS4CHCJMMj9tW24t7X+0qBVPdvxoH+Y6I:ik6F7RfpPF9UIyw4CHCV9tW2l0W0mWnj

Entry address:
0x80DF6

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.9340

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
508 KB (520,192 bytes)

Service
Display name:
Update Hold Page

Type:
Win32OwnProcess


The file utilholdpage.exe has been discovered within the following program.

Hold Page  by Yontoo Technology, Inc.
Hold Page is an adware program that installs as a web browser plugin to inject and display advertisements.
holdingmypage.com/support
87% remove it
 
Powered by Should I Remove It?

Remove utilholdpage.exe - Powered by Reason Core Security