Categories: Malware

About “AdWare.Win32.Qjwmonkey.jzo” infection

The AdWare.Win32.Qjwmonkey.jzo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Qjwmonkey.jzo virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine AdWare.Win32.Qjwmonkey.jzo?


File Info:
name: EFABC88E7ABA88562AE1.mlwpath: /opt/CAPEv2/storage/binaries/4af7637c25f94b2496dbf18c5815066f5cbcccef441ac680c1a145a0e419abfbcrc32: BC816275md5: efabc88e7aba88562ae1e6c943c2b50fsha1: 435b4b248074875198198c42b92a2f17474aca71sha256: 4af7637c25f94b2496dbf18c5815066f5cbcccef441ac680c1a145a0e419abfbsha512: 281e11df3974222bfafdb0d8ae016ac29c5f63311712f43795709a98fd9dca167b7632c73a0ae6de1131f06d3dce5c9bb666b39c722040d3665ed7c3bec48d3essdeep: 12288:SXGoW3fktoVWrtMarYplm6xdSXtas6zHa+ZTPeYElzC7YCaIEdaBECx0/blc:SDGgZalmWgQbu+9PeYP74daB9x4atype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18AE42339D6464C12E429DD377D21C57D10A0FC4AE69C212618C6BF8F6D76B22322EB5Fsha3_384: ffd7dae4c5f99d3b713ebc5ddceb72502b8db10cc34df4adb72ca14ddc6992a7000bb43a339aca7f9e6a19d65eff593dep_bytes: 60be005050008dbe00c0efffc7874c6etimestamp: 2021-01-12 08:08:21
Version Info:
FileDescription: _FileVersion: 6.0.0.0112InternalName: 智能下载器.exeLegalCopyright: Copyright (C) 2021OriginalFilename: 智能下载器.exeProductName: 智能下载器.exeTranslation: 0x0804 0x04b0

AdWare.Win32.Qjwmonkey.jzo also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Application.Downloader.Nezchi.1
CAT-QuickHeal	PUA.GenericRI.S18206529
McAfee	GenericRXAA-AA!EFABC88E7ABA
Cylance	Unsafe
Zillya	Adware.Qjwmonkey.Win32.783
K7AntiVirus	Adware ( 005105151 )
K7GW	Adware ( 005105151 )
Cybereason	malicious.e7aba8
Cyren	W32/Qjwmonkey.I.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Adware.Qjwmonkey.H
APEX	Malicious
Kaspersky	not-a-virus:AdWare.Win32.Qjwmonkey.jzo
BitDefender	Gen:Variant.Application.Downloader.Nezchi.1
Avast	Win32:Sality [Inf]
Tencent	Pua:Adware.Win32.Downloader.16000011
Ad-Aware	Gen:Variant.Application.Downloader.Nezchi.1
Emsisoft	Gen:Variant.Application.Downloader.Nezchi.1 (B)
VIPRE	Virus.Win32.Sality.atbh (v)
TrendMicro	PE_SALITY.ER
McAfee-GW-Edition	BehavesLike.Win32.BadFile.jc
FireEye	Generic.mg.efabc88e7aba8856
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Application.Downloader.Nezchi.1
Jiangmin	Win32/HLLP.Kuku.poly2
Avira	ADWARE/Qjwmonkey.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.312DFBA
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	PUP/Win32.Installer.C4315114
VBA32	BScope.Adware.Qjwmonkey
ALYac	Gen:Variant.Application.Downloader.Nezchi.1
MAX	malware (ai score=76)
Malwarebytes	Adware.Qjwmonkey
TrendMicro-HouseCall	PE_SALITY.ER
Rising	Adware.Downloader!1.BDCA (CLASSIC)
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Adware/Qjwmonkey
BitDefenderTheta	Gen:NN.ZexaF.34062.RmMfaqOeU1kj
AVG	Win32:Sality [Inf]