netfilter64.sys

NetFilter SDK

Adpeak, Inc.

Part of an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The file netfilter64.sys, “NetFilter SDK TDI Hook Driver (WPP)” by Adpeak has been detected as adware by 3 anti-malware scanners. It runs as a Windows 64-bit kernel mode device driver named “netfilter64”. This file is typically installed with the program SavingsBullFilter by Adpeak, Inc. which is a potentially unwanted software program.
Publisher:
NetFilterSDK.com  (signed by Adpeak, Inc.)

Product:
NetFilter SDK

Description:
NetFilter SDK TDI Hook Driver (WPP)

Version:
1.4.3.1 built by: WinDDK

MD5:
3e71b9d55ede56bf5e11e923c0d09874

SHA-1:
9ca71c727934861e9351af97cc28cea38811b07c

SHA-256:
25d314f94f52970843eecb855a39dda9e2bf0077a5ce7cb5da83f139c421825f

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Injects advertisements in the web browser in the form or banner ads and popups.

Analysis date:
3/6/2021 12:54:58 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
MalSign.Adpeak
2015.0.3577

Reason Heuristics
PUP.Adpeak.O
14.8.7.17

VIPRE Antivirus
Adware.Adpeak
25992

File size:
60.1 KB (61,592 bytes)

Product version:
1.4.3.1

Copyright:
Copyright © 2013 NetFilterSDK.com

Original file name:
netfilter2.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\netfilter64.sys

Digital Signature
Signed by:

Authority:
DigiCert Inc

Valid from:
7/17/2013 8:00:00 PM

Valid to:
9/24/2014 8:00:00 AM

Subject:
CN="Adpeak, Inc.", O="Adpeak, Inc.", L=Sarasota, S=Florida, C=US

Issuer:
CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0E4C86026B3F1F3BDBEDF4DA58E8FF09

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
1536:KaDltS1O+G9IODA2VLcN4W5J0y9/ngJPNJsVnE:LxtS1dGtMfJ0y9PgJPNJsVE

Entry point:
48, 8B, 05, F1, D0, FF, FF, 49, B9, 32, A2, DF, 2D, 99, 2B, 00, 00, 48, 85, C0, 74, 05, 49, 3B, C1, 75, 2F, 4C, 8D, 05, D6, D0, FF, FF, 48, B8, 20, 03, 00, 00, 80, F7, FF, FF, 48, 8B, 00, 49, 33, C0, 49, B8, FF, FF, FF, FF, FF, FF, 00, 00, 49, 23, C0, 49, 0F, 44, C1, 48, 89, 05, AE, D0, FF, FF, 48, F7, D0, 48, 89, 05, AC, D0, FF, FF, E9, BB, B3, FF, FF, CC, CC, CC, B0, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 20, 05, 01, 00, 10, C0, 00, 00, A0, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 42, 05, 01, 00...
 
[+]

Entropy:
6.3705

Driver
Display name:
netfilter64

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


The file netfilter64.sys has been discovered within the following program.

SavingsBullFilter  by Adpeak, Inc.
Savings Bull is a potentially unwanted web browser extension that is ad-supported /affiliate coupon supported and will display various popup and banner ads as well as modify the user's web browser search and home page settings.
www.savingsbull.com
79% remove it
 
Powered by Should I Remove It?

Remove netfilter64.sys - Powered by Reason Core Security