home

LinksicleClientIE.dll

Linksicle Client BHO x64

Linksicle

This is part of the InfoAtoms browser extension which will display variopus forms of advertising in the web browser by injecting new ads such as banner, text-links and search results. The module LinksicleClientIE.dll by Linksicle has been detected as adware by 15 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘Linksicle’.
Publisher:
Linksicle  (signed and verified)

Product:
Linksicle Client BHO x64

Version:
1.8.2.0

MD5:
f8d6cd1139a156c236e93d5f0baf476b

SHA-1:
25067c5e4026db2833590f03f6721f71f756d06d

SHA-256:
747ac5c049e21043a34f65912c6edcc11c860a426a540b797f5f75d9298762f0

Scanner detections:
15 / 68

Status:
Adware

Analysis date:
12/24/2024 12:05:09 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.AdPage.A
1053

Avira AntiVirus
TR/Trash.Gen
7.11.142.34

Baidu Antivirus
Adware.Win64.Vitruvian
4.0.3.141117

Bitdefender
Adware.AdPage.A
1.0.20.385

Emsisoft Anti-Malware
Adware.AdPage
8.14.05.10.03

ESET NOD32
Win64/Adware.Vitruvian.B application
8.7.0.302.0

F-Secure
Adware.AdPage.A
11.2014-18-03_3

G Data
Adware.AdPage
14.3.24

IKARUS anti.virus
AdWare.AdPage
t3scan.2.2.29

MicroWorld eScan
Adware.AdPage.A
15.0.0.231

nProtect
Adware.AdPage.A
14.04.08.01

Reason Heuristics
PUP.BHO.Linksicle.R
14.8.7.20

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
10615

Trend Micro House Call
TROJ_GEN.F47V1213
7.2.77

VIPRE Antivirus
Linksicle
24446

File size:
172 KB (176,168 bytes)

Product version:
1.8.2.0

Copyright:
Copyright (C) 2013

Original file name:
LinksicleClientIE.dll

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Program Files\linksicle\ie\linksicleclientie.dll

Digital Signature
Signed by:
Linksicle

Authority:
GlobalSign nv-sa

Valid from:
5/15/2013 10:59:47 AM

Valid to:
5/16/2014 10:59:47 AM

Subject:
E=support@linksicle.com, CN=Linksicle, O=Linksicle, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11212949C7E0DD2DAE02FDADCB01A5928F0B

Registration
CLSID:
{2AD2D8CA-D24D-40D2-A8FC-46952409BA9A}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
10/2/2013 5:14:22 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:4xOvmPm2gDTo4if+1eejTqpyX/TF+c212tIR5KaDrVxA4Ynpw:GOvUyDMbejTZX5cRwSBIw

Entry address:
0xE674

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 6B, 53, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 03, 00, 00, 00, CC, CC, CC, 48, 8B, C4, 48, 89, 58, 20, 4C, 89, 40, 18, 89, 50, 10, 48, 89, 48, 08, 56, 57, 41, 56, 48, 83, EC, 50, 49, 8B, F0, 8B, DA, 4C, 8B, F1, BA, 01, 00, 00, 00, 89, 50, B8, 85, DB, 75, 0F, 39, 1D, 60, 9E, 01, 00, 75, 07, 33, C0, E9, D2, 00, 00, 00, 8D, 43, FF...
 
[+]

Entropy:
5.8648

Code size:
91 KB (93,184 bytes)

Internet Explorer BHO
Display name:
Linksicle

CLSID:
{2AD2D8CA-D24D-40D2-A8FC-46952409BA9A}


Remove LinksicleClientIE.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.