» WebSocket4Net.dll
Overview
Analysis
File Details

WebSocket4Net.dll

Kimahri Software inc.

This adware uses the Crossrider platform to build and distribute this web browser advertising injection extension. Once installed in the browser it will hijack various browser settings (homepage, search) and may interfere and track behaviors as well as deliver ads. The module WebSocket4Net.dll, “WebSocket4Net for .NET 2.0” by Kimahri Software inc has been detected as adware by 29 anti-malware scanners. The library is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is distributed as part of the Brightcircle group of browser-extensions.

File name:

WebSocket4Net.dll

Publisher:

WebSocket4Net (signed by Kimahri Software inc.)

Product:

WebSocket4Net

Description:

WebSocket4Net for .NET 2.0

Version:

0.9.0.0

MD5:

78f68db85157beebd3632a5531e41f71

SHA-1:

bc16f922d7feb65ab9fc3144638b75cc834d37c8

SHA-256:

778adcd10ce22f6a274f7159fce76947f4fc04b4c9bce40687c5378ddea53b3b

Scanner detections:

29 / 68

Status:

Adware

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements. Distributed through the Brightcircle investments brand.

Analysis date:

4/24/2024 3:22:58 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.SwiftBrowse.BW

489

AhnLab V3 Security

PUP/Win32.SwiftBrowse

2015.01.04

avast!

Win32:Crossrider-DL [PUP]

2014.9-151004

AVG

Potentially harmful program Crossrider

2016.0.2967

Baidu Antivirus

Adware.Win32.CrossAd

4.0.3.15104

Bitdefender

Adware.SwiftBrowse.BW

1.0.20.1385

Clam AntiVirus

Win.Trojan.Swiftbrowse-14

0.98/20547

Dr.Web

Trojan.Crossrider1.25262

9.0.1.0277

Emsisoft Anti-Malware

Adware.SwiftBrowse.BW

8.15.10.04.12

ESET NOD32

Win32/Toolbar.CrossRider.BM potentially unwanted application

9.7.0.302.0

F-Prot

W32/A-7f649687

v6.4.7.1.166

F-Secure

Adware.SwiftBrowse.BW

11.2015-04-10_1

G Data

Adware.SwiftBrowse.BW

15.10.24

IKARUS anti.virus

PUA.Plush

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.185.14098

Kaspersky

not-a-virus:WebToolbar.Win32.CroRi

14.0.0.1330

McAfee

Artemis!734863B184F1

5600.6623

MicroWorld eScan

Adware.SwiftBrowse.BW

16.0.0.831

NANO AntiVirus

Trojan.Win32.Crossrider.dkkxmt

0.30.0.64448

Norman

Adware.SwiftBrowse.BW

11.20151004

nProtect

Adware.SwiftBrowse.BW

14.10.05.01

Panda Antivirus

Trj/CI.A

15.10.04.12

Qihoo 360 Security

Win32/Virus.WebToolbar.80e

1.0.0.1015

Reason Heuristics

PUP.Brightcicrle.Brightcircle (M)

15.10.4.0

Sophos

PUA 'AppRider' (of type Adware)

5.15

Total Defense

Win32/Tnega.DHebTdC

37.0.11210

Trend Micro House Call

Suspicious_GEN.F47V0725

7.2.277

Vba32 AntiVirus

Trojan.GoogUpdate

3.12.26.3

VIPRE Antivirus

Threat.4150696

40786

File size:

62.9 KB (64,360 bytes)

Product version:

0.9.0.0

Original file name:

WebSocket4Net.dll

File type:

Dynamic link library (Win32 DLL)

Language:

Language Neutral

Common path:

C:\Program Files\clip-high_d_06\websocket4net.dll

Digital Signature

Signed by:

Kimahri Software inc.

Authority:

COMODO CA Limited

Valid from:

3/6/2013 4:00:00 PM

Valid to:

3/6/2016 3:59:59 PM

Subject:

CN=Kimahri Software inc., O=Kimahri Software inc., STREET=666 Sherbrooke Rue w, L=Montreal, S=Quebec, PostalCode=H3A 1E7, C=CA

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00A1BB8569950C0B2080A11A0E2F618B33

File PE Metadata

Compilation timestamp:

5/26/2014 6:13:38 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

11.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

1536:YrKEBvRG7IE/kWkMm+kDjHz66x8ljDAMIonIg7Tot:YrXBv07cEm+knHz66iljDAMIonIg7Tw

Entry address:

0xFFCE

Entry point:

FF, 25, 00, 20, 00, 10, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 10, 00, 00, 00, 18, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 01, 00, 00, 00, 30, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 48, 00, 00, 00, 58, 00, 01, 00, AC, 03... 
[+]

Entropy:

5.8770

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

56 KB (57,344 bytes)

Remove WebSocket4Net.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.