Categories: Malware

AdWare.Win32.Agent.xxyqfk (file analysis)

The AdWare.Win32.Agent.xxyqfk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Agent.xxyqfk virus can do?

Presents an Authenticode digital signature
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Queries information on disks, possibly for anti-virtualization
Network activity contains more than one unique useragent.
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

api.ip138.com

ab.popodi.com

a.tomx.xyz

down.xiald.com

down.popodi.com

www.9973.com

xzqtj.xiald.com

How to determine AdWare.Win32.Agent.xxyqfk?


File Info:
crc32: AB3DEC74md5: ff549cf33960f0af24eef8fd25ccaf4ename: ____________3___________________131_457150.exesha1: 8f700c74c9a518889fa625b9d5c1839ac26fc2b7sha256: b12b986add0a4fd3b86226381b1ab3586c28c5eb361eb43ee6c342f0867a5489sha512: 55ec3cbcf1ab883102908ec341e7226eb74e6d75f5c011815509e4ab22a229ca125999ea745684bfac59b4abd3709039ba6b851367a8d173f05e42ba84a9908assdeep: 49152:kzLVynqoiJE0O7Pfjouypc8ILJ0Yzr0uetadb7rzHWnsghMYj:6MqouOvouyp7oSueta9nSnswtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2018InternalName: x9ad8x901fx4e0bx8f7dx5668FileVersion: 1.5.2.19924CompanyName: x9ad8x901fx4e0bx8f7dx5668ProductName: x9ad8x901fx4e0bx8f7dx5668ProductVersion: 1,5,2,19924FileDescription: x9ad8x901fx4e0bx8f7dx5668OriginalFilename: Install.exeTranslation: 0x0804 0x04b0

AdWare.Win32.Agent.xxyqfk also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Trojan.GenericKD.32669377
FireEye	Generic.mg.ff549cf33960f0af
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	GenericRXJC-ZY!FF549CF33960
ALYac	Trojan.GenericKD.32669377
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Adware ( 004d97001 )
BitDefender	Trojan.GenericKD.32669377
K7GW	Adware ( 004d97001 )
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Softcnapp.J potentially unwanted
APEX	Malicious
GData	Trojan.GenericKD.32669377
Kaspersky	not-a-virus:AdWare.Win32.Agent.xxyqfk
Alibaba	AdWare:Win32/Softcnapp.208c9ce1
ViRobot	Adware.Agent.2511784
Avast	Win32:AdwareX-gen [Adw]
Tencent	Malware.Win32.Gencirc.10b0bbe3
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.32669377 (B)
DrWeb	Adware.Softcnapp.119
Zillya	Adware.Agent.Win32.145969
McAfee-GW-Edition	GenericRXJC-ZY!FF549CF33960
Sophos	Generic PUA IP (PUA)
Jiangmin	Adware.Agent.akso
MAX	malware (ai score=89)
Antiy-AVL	GrayWare[AdWare]/Win32.Agent
Arcabit	Trojan.Generic.D1F27EC1
AhnLab-V3	PUP/Win32.Softcnapp.R293787
ZoneAlarm	not-a-virus:AdWare.Win32.Agent.xxyqfk
Microsoft	PUA:Win32/CoinMiner
VBA32	BScope.Adware.Puwaders
Ad-Aware	Trojan.GenericKD.32669377
Malwarebytes	PUP.Optional.Softcnapp
Rising	Adware.Downloader!1.BBEC (CLOUD)
Yandex	PUA.Agent!
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.73379846.susgen
Fortinet	Adware/Agent
Webroot	W32.Adware.Gen
AVG	Win32:AdwareX-gen [Adw]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)