Reason Labs

{44510e38-40e0-41ab-af7a-6c9085d16837}.dll

Wander Burst

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module {44510e38-40e0-41ab-af7a-6c9085d16837}.dll by Wander Burst has been detected as Adware.Yontoo. It is also typically executed from the user's temporary directory.
Publisher:
Wander Burst  (signed and verified)

Version:
1.0.5699.21095

MD5:
60f287b98593c7f57cdaaf9027251d44

SHA-1:
1ec56a86f2fa84525a28063dcd46688a8336cbd9

SHA-256:
7f3d4d9caf8e64321f09a7171050b90099e5dcee35cbcf48510649aab6026da3

Detection:
Adware.Yontoo

Risk:
Medium

Explanation:
Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser.

Analysis date:
11/16/2018 1:19:23 PM UTC  (today)

File size:
530.7 KB (543,456 bytes)

Product version:
1.0.5699.21095

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{44510e38-40e0-41ab-af7a-6c9085d16837}.dll

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
6/18/2015 9:00:00 PM

Valid to:
6/18/2016 8:59:59 PM

Subject:
CN=Wander Burst, O=Wander Burst, L=San Diego, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4A9C9001F9FFB60F7F507CDFCDC1B744

File PE Metadata
Compilation timestamp:
8/9/2015 3:43:19 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x1C185

Entry point:
55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 09, 8E, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, 60, 59, 05, 10, E8, FC, 2D, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 8C, 01, 08, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, BC, 65, 04, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Characteristics:
0x8450

Code size:
272.5 KB (279,040 bytes)

There are numerous known code variantions that share the same compilation structure.

Adware.Yontoo
{1d9a77f8-dfc2-48e3-b1e8-8a620371eb5a}.dll  1.0.5701.24598  (a96820fa92bca831e8cfed972c6f0a6a5a4bc726)

Adware.Yontoo
{cffc0784-1abc-4d55-a7e4-e5a5e9d2bd01}.dll  1.0.5701.24598  (3275d49d0a69db09698f353117905311f2e3ec29)

Adware.Yontoo
{64c1fc76-24a8-4ea5-b5bc-22ccbc274324}.dll  1.0.5701.15598  (9c58c789dcd64a507ab35aabc4e6388fc3a393c5)

Adware.Yontoo
{988e552f-6a5e-44ab-b09f-ca243cb1148e}.dll  1.0.5701.15598  (77f7b9069b40a60368dad9e7dc4215c18510a893)

Adware.Yontoo
{42bc2542-f8b0-44bd-8cfd-d59b2cad89ea}.dll  1.0.5701.6636  (21f84157d20113ff776c349cb1fd992aaebf85e1)

Adware.Yontoo
{a678e898-ac78-4fdd-b7f9-f6f8d2f1fc33}.dll  1.0.5700.31843  (6cd93f9eb1c2e78af94c065947776c97f0411878)

Adware.Yontoo
{f5d5771b-6085-41b4-b37b-82b7619ebaf3}.dll  1.0.5700.22805  (8d575d1757bf53e36724a9f3487f1e3a13528f28)

Adware.Yontoo
{bd6a5d77-5318-49e2-934b-ade2ca1612c5}.dll  1.0.5700.13847  (eb9b2759bc1cd1f7a1ece911ef8b2a006ab2e9e7)

Adware.Yontoo
{0c652a72-3fd7-4e9d-b9b2-4d62a5ff1914}.dll  1.0.5700.4901  (31f59768a162975a2390a0d358b647e18fc1ec1b)

Adware.Yontoo
{0b5029df-d229-4a1e-b164-325ffefd67f4}.dll  1.0.5699.3093  (850e542b0d5a2b37853f8fda33be7c43e5976aab)

Adware.Yontoo
{3203ad8d-ce35-4602-8d02-cc8ef4556399}.dll  1.0.5696.24671  (df3dddb9b10c7ad2eb46dcc3d2649289e6028185)

Adware.Yontoo
{735f3912-7858-4ceb-8bdd-96dd06391cfd}.dll  1.0.5696.15664  (515bae09d1d75864c170631c6a7a380eb84c669c)

Adware.Yontoo
{040615ac-4318-4a21-94d1-588fc28caa2a}.dll  1.0.5696.6650  (f44e7c1e715686909403dca42c460f36826308fd)

Adware.Yontoo
{519d203e-cea3-454e-86ab-247d8c260fa6}.dll  1.0.5695.31840  (fec3002d97bddda0e8fa60169205d2aa6374a837)

Adware.Yontoo
{62a06826-f585-4eeb-8c7c-27d4413898f0}.dll  1.0.5695.24019  (9fcd6920cf5cecad0004d8c7655de4e842aba508)

Adware.Yontoo.WanderBurst.Installer
setup.exe  (5d1e74a8de10817e6d0d1ae9dde9549a7529eb8b)

Adware.Yontoo
plugincontainer.exe  (790d2ee8d295f51d021a5a8ea65a275faaee7c05)

Adware.Yontoo
updater.exe  (a9d1a6e8d6ccc51ddbe55f7f2b444643e1ccd5fe)

Adware.Yontoo.WanderBurst
plugin.exe  (d3b5d012118cae0c9970dec2a74a611c6e325141)

Adware.Yontoo
0f4e02f8-f10e-493d-a1a7-3aed7ba7b110.dll  (484cb43a45a7c733d77899603361cb5d025eae92)

Adware.Yontoo
34.0.5.dll  (1d293258c9061b45738b2ffc31d9461774062cae)

Adware.Yontoo
38.0.5.dll  (0ac2d83c767862719884b611aa98b6901ffce95a)

Adware.Yontoo
39.0.0.dll  (ef6333176bd4936b46111fe7f6d3e2a416fae1d2)

Download Reason Core Security - Powerful anti-malware software