home

Interop.Shell32.dll

Assembly imported from type library 'Shell32'.

Secure Installer Inc

This is part of the Air Installer, a download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file Interop.Shell32.dll, re-signed by Secure Installer Inc, is an Interop assembly that has been intergated by a 3rd-party into a .Net application, even though the assembly itself is most likely safe, it has been recompiled by a potentially unwanted program.
Publisher:
Secure Installer Inc  (signed and verified)

Product:
Assembly imported from type library 'Shell32'.

Version:
1.0.0.0

MD5:
99eff7bfd4c3180d290a161fea48d9c5

SHA-1:
368e1e67b35830b5ce54af4c35f7399d74035974

SHA-256:
5e2910b34eb33406bfdb46f9d51d7ee6d2e7bdbbe1ab2c9797f275d82464fa0e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/5/2024 1:41:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Air Software (M)
17.2.28.14

File size:
54.1 KB (55,416 bytes)

Product version:
1.0.0.0

Original file name:
Interop.Shell32.dll

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\driverrestore\interop.shell32.dll

Digital Signature
Signed by:
Secure Installer Inc

Authority:
Symantec Corporation

Valid from:
10/27/2015 6:00:00 PM

Valid to:
11/18/2018 5:59:59 PM

Subject:
CN=Secure Installer Inc, O=Secure Installer Inc, L=Pleasanton, S=California, C=US, SERIALNUMBER=C3712890, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
22AA79DFC593B122228F38161FC4414F

File PE Metadata
Compilation timestamp:
1/30/2017 11:31:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

Entry address:
0xA71E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
4.9447

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
36 KB (36,864 bytes)

Remove Interop.Shell32.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.