» WebSocket4Net.dll
Overview
Analysis
File Details

WebSocket4Net.dll

BadFinger Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The module WebSocket4Net.dll, “WebSocket4Net for .NET 2.0” by BadFinger Project (BrightCircle Investments Limited) has been detected as adware by 28 anti-malware scanners. The library is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

WebSocket4Net.dll

Publisher:

WebSocket4Net (signed by BadFinger Project (BrightCircle Investments Limited))

Product:

WebSocket4Net

Description:

WebSocket4Net for .NET 2.0

Version:

0.9.0.0

MD5:

8f75ee39d3bd0e5a28f3f33d7e04020d

SHA-1:

2f499b5b7fa3de17845fd17bceb2fb8de07df11c

SHA-256:

e8b130479c60fb3d6169705758d962908a1ee67df3dad766d1ee61941a0939a7

Scanner detections:

28 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Analysis date:

5/4/2024 3:53:19 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.BW

6212261

AhnLab V3 Security

PUP/Win32.SwiftBrowse

2014.12.11

Avira AntiVirus

Worm/Bagle.AT.Rsv1

7.11.30.172

AVG

Generic

2015.0.3253

Baidu Antivirus

PUA.Win32.CrossRider

4.0.3.141221

Bitdefender

Adware.SwiftBrowse.BW

1.0.20.1775

Clam AntiVirus

Win.Trojan.Swiftbrowse-14

0.98/19819

Dr.Web

Trojan.Crossrider.28247

9.0.1.05190

Emsisoft Anti-Malware

Adware.SwiftBrowse.BW

9.0.0.4668

ESET NOD32

Win32/Toolbar.CrossRider.BM potentially unwanted application

7.0.302.0

F-Prot

W32/A-465c2731

v6.4.7.1.166

F-Secure

Adware.SwiftBrowse.BW

5.13.68

G Data

Adware.SwiftBrowse.BW

14.12.24

K7 AntiVirus

Unwanted-Program

13.186.14210

Kaspersky

not-a-virus:AdWare.NSIS.Adwapper

15.0.0.543

McAfee

Artemis!B90FB951C32D

5600.6909

MicroWorld eScan

Adware.SwiftBrowse.BW

15.0.0.1065

NANO AntiVirus

Trojan.Win32.Crossrider.dkkxmt

0.28.6.63850

Norman

Adware.SwiftBrowse.BW

04.12.2014 14:30:06

nProtect

Adware.SwiftBrowse.BW

14.12.02.01

Panda Antivirus

Trj/CI.A

14.12.21.10

Qihoo 360 Security

HEUR/QVM23.0.Malware.Gen

1.0.0.1015

Reason Heuristics

Adware.BrightCircle.BadFingerProjectBrightCircleInvestmentsLimited.N

14.12.21.22

Sophos

PUA 'AppRider' (of type Adware)

5.09

Total Defense

Win32/Tnega.DHebTdC

37.0.11310

Vba32 AntiVirus

Trojan.GoogUpdate

3.12.26.3

VIPRE Antivirus

Threat.4150696

35418

ViRobot

Adware.SwiftBrowse.64480.C[h]

2014.3.20.0

File size:

63 KB (64,480 bytes)

Product version:

0.9.0.0

Original file name:

WebSocket4Net.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\Program Files\browserappsplus2.1\websocket4net.dll

Digital Signature

Signed by:

BadFinger Project (BrightCircle Investments Limited)

Authority:

COMODO CA Limited

Valid from:

11/16/2014 4:00:00 PM

Valid to:

11/17/2015 3:59:59 PM

Subject:

CN=BadFinger Project (BrightCircle Investments Limited), O=BadFinger Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Cyprus, PostalCode=2025, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6623FAFCAC357577A31D90C1E567E9A7

File PE Metadata

Compilation timestamp:

5/26/2014 6:13:38 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

1536:UrKEBvRG7IE/kWkMm+kDjHz66x8ljDAMIonIg7T7Z:UrXBv07cEm+knHz66iljDAMIonIg7Tt

Entry address:

0xFFCE

Entry point:

FF, 25, 00, 20, 00, 10, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 10, 00, 00, 00, 18, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 30, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 48, 00, 00, 00, 58, 00, 01, 00, AC, 03... 
[+]

Entropy:

5.8803

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

56 KB (57,344 bytes)

Remove WebSocket4Net.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.