» gatesnapperbho.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Downloads (2)

gatesnapperbho.dll

gate snapper

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The module gatesnapperbho.dll by gate snapper has been detected as adware by 60 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘gate snapper 1.0.0.7’. This file is typically installed with the program gate snapper by Yontoo Technology, Inc. which is a potentially unwanted software program. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.

File name:

gatesnapperbho.dll

Publisher:

gate snapper (signed and verified)

Product:

gate snapper

Version:

1.0.0.7

MD5:

dc11c5734a215ec2996868b5bcea5431

SHA-1:

fc0406db07f938d0a8c4790975944ceb36945404

SHA-256:

24cbd470b046369d12eea098e9d8c4955dffab3f55c491b9f10bea753e7adda8

Scanner detections:

60 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

12/27/2024 6:19:09 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.BrowseFox.BJ

689

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

Adware/Win32.BrowseFox

2015.01.27

Avira AntiVirus

ADWARE/BrowseFox.Gen2

7.11.209.134

avast!

MSIL:BrowseFox-BE [PUP]

2014.9-150318

AVG

Generic

2016.0.3167

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.15318

Bitdefender

Adware.BrowseFox.BJ

1.0.20.385

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Browsefox-536

0.98/20194

Comodo Security

Application.Win32.BrowseFox.JM

20860

Dr.Web

Trojan.BPlug.215

9.0.1.077

Emsisoft Anti-Malware

Adware.BrowseFox.BJ

8.15.03.18.11

ESET NOD32

Win32/BrowseFox.AE potentially unwanted application

9.7.0.302.0

Fortinet FortiGate

Riskware/BrowseFox

3/18/2015

F-Prot

W32/S-7bed2e86

v6.4.7.1.166

F-Secure

Adware.BrowseFox.BJ

11.2015-18-03_4

G Data

Adware.BrowseFox.BJ

15.3.25

herdProtect (fuzzy)

variant of gatesnapper.dll (Adware)

2015.6.24.7

IKARUS anti.virus

AdWare.BrowseFox

t3scan.1.8.6.0

K7 AntiVirus

Trojan

13.192.14761

Kaspersky

not-a-virus:AdWare.Win32.Agent

14.0.0.2328

Malwarebytes

PUP.Optional.GateSnapper.A

v2015.03.18.11

McAfee

BrowseFox

5600.6823

MicroWorld eScan

Adware.BrowseFox.BJ

16.0.0.231

NANO AntiVirus

Trojan.Win32.Yontoo.dnkubo

0.30.0.65070

Norman

Gen:Variant.Adware.BetterBrowse.1

11.20150318

nProtect

Adware.BrowseFox.BJ

15.01.26.01

Panda Antivirus

Trj/CI.A

15.03.18.11

Qihoo 360 Security

HEUR/QVM30.1.Malware.Gen

1.0.0.1015

Quick Heal

PUA.Adware.OD5

3.15.14.00

Reason Heuristics

PUP.BHO.Yontoo

15.3.18.11

Rising Antivirus

PE:Trojan.Win32.Generic.17D5649F!399860895

23.00.65.15316

Sophos

Generic PUA CC

4.98

SUPERAntiSpyware

Adware.BrowseFox/Variant

9990

Trend Micro House Call

Suspicious_GEN.F47V0204

7.2.77

Trend Micro

TROJ_GEN.F0C2C00LH14

10.465.18

Vba32 AntiVirus

AdWare.Kranet

3.12.26.3

VIPRE Antivirus

Yontoo

37004

Zillya! Antivirus

Backdoor.PePatch.Win32.58304

2.0.0.2033

File size:

262.7 KB (269,048 bytes)

Product version:

1.0.0.7

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\gate snapper\gatesnapperbho.dll

Digital Signature

Signed by:

gate snapper

Authority:

VeriSign, Inc.

Valid from:

11/20/2014 1:00:00 AM

Valid to:

11/21/2015 12:59:59 AM

Subject:

CN=gate snapper, O=gate snapper, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

133A7A0373BA5F8F11B450D044B92146

File PE Metadata

Compilation timestamp:

3/12/2015 4:26:20 AM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

3072:ImiYckxqEbUViVqUsVNXBB+/nFK3wY+lx9ZKTkhKjFcEn:ImiYckziiVMrXFdI9ZLYSo

Entry address:

0xF515

Entry point:

55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, EA, 7E, 00, 00, FF, 75, 10, FF, 75, 0C, FF, 75, 08, E8, 07, 00, 00, 00, 83, C4, 0C, 5D, C2, 0C, 00, 6A, 0C, 68, D8, 21, 03, 10, E8, 4C, 02, 00, 00, 33, C0, 40, 8B, 75, 0C, 85, F6, 75, 0C, 39, 35, 4C, 77, 03, 10, 0F, 84, E4, 00, 00, 00, 83, 65, FC, 00, 83, FE, 01, 74, 05, 83, FE, 02, 75, 35, 8B, 0D, C4, 93, 02, 10, 85, C9, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D1, 89, 45, E4, 85, C0, 0F, 84, B1, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 11, FE, FF, FF, 89, 45, E4... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

159 KB (162,816 bytes)

Internet Explorer BHO

Display name:

gate snapper 1.0.0.7

CLSID:

{4a532aa9-cf26-4fd4-b245-cb4e3b401af9}

The file gatesnapperbho.dll has been discovered within the following programs.

gate snapper by Yontoo Technology, Inc.

This is browser adware. It installs in the user's web browser and while running will display unwanted ads from malicious software and other adware. It is bundled through download managers.

gatesnapper.com/support

87% remove it

The file gatesnapperbho.dll has been seen being distributed by the following 2 URLs.

http://install-cdn.gatesnapper.com/bed?r=2015031219&bet=3

http://install-cdn.gatesnapper.com/bed?r=2015031214&bet=3

Remove gatesnapperbho.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.