DPower

By GoldSparrow in Adware

Threat Scorecard

Threat Level: 20 % (Normal)
Infected Computers: 32
First Seen: August 19, 2016
Last Seen: March 18, 2026
OS(es) Affected: Windows

Computer users that like to keep their machines well protected by security applications may be shocked by a large amount of advertisements displayed by an adware-laced program called DPower. Adware-laced programs such as DPower may enter a computer bundled with freeware. DPower is considered as adware due to the various issues it can bring to an affected computer. These issues may include a decreased performance of the machine, browsing details been monitored, redirections to corrupted websites and more. The adware behind DPower may cause the appearance of disturbing and unwanted advertisements that will cover any visited Web page.

Dpower also may monitor the computer users browsing actions and collect information that may be used by third parties for marketing purposes. Also, by clicking on the advertisements displayed by Dpower, the computer user may be directed to websites with unsafe content. Since Dpower may have entered the computer bundled with a third-party free program downloaded by the computer user, it's very important to be careful when downloading new programs from unknown sources. DPower should be removed from the affected computer with a malware remover tool.

Analysis Report

General information

Family Name: Adware.Linkury.M
Signature status: No Signature

Known Samples

MD5: 670d070a04b44ad6e597b9c483e45c00
SHA1: 70fe2d2d289b76ba682d2a73919476df0f9b4d43
SHA256: 9441F068DC4A87112F8F37CC5A28D25B2551208CB612A6605397C67A0828DCCB
File Size: 676.35 KB, 676352 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • HighEntropy
  • No Version Info
  • x86

Block Information

Total Blocks: 356
Potentially Malicious Blocks: 19
Whitelisted Blocks: 335
Unknown Blocks: 2

Visual Map

? ? 0 0 0 x x x 0 x 0 0 x x x 0 x x x 0 x 0 x x x x 0 0 x x x x 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 1 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 2 3 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 0 0 0 0 2 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 1 0 1 0 0 0 0 2 2 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
\\dani\pipe\lsarpc Generic Read,Write Data,Write Attributes,Write extended,Append data

Related Posts

Trending

Most Viewed

Loading...