AdWare.Win32.Qjwmonkey.lrt (file analysis)

The AdWare.Win32.Qjwmonkey.lrt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Qjwmonkey.lrt virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine AdWare.Win32.Qjwmonkey.lrt?

File Info:
name: 4B610C584FAAEB2AC8FE.mlw
path: /opt/CAPEv2/storage/binaries/ea7df9fb33e9713f07a06b0f5e036bfca1ef2e90604c9322918411eb0fc3d512
crc32: 4BDD0AD3
md5: 4b610c584faaeb2ac8fef49b9a7c5e7c
sha1: 4f25c7aa7fd6a6b09152f0c0a167cb9c0d2c367d
sha256: ea7df9fb33e9713f07a06b0f5e036bfca1ef2e90604c9322918411eb0fc3d512
sha512: 5e95d2b98ccc590a27f9c0a1b67d6887647c726c6ddda11fa1dbbeb0a5e950d635b18013e4198b172baedf94ddfebd1249aa8e6e3af85cdcc58aa006eae6af6d
ssdeep: 12288:MC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspd:MC6wp1vfhboOb66Uyavk8hdo+g8BOONg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18EE42231EAA94801F21BCD377951C6B22878FC44D3D1920B67DCBF63ABBA711513866E
sha3_384: 0c621a018f2edddd2ed1c5e246854e5c444516abf56c11c493e42c7f5a24f02ebd3c2143a861c581bb33787e00d85c7c
ep_bytes: 60be00d050008dbe0040efffc787a461
timestamp: 2021-11-11 11:21:42

Version Info:
FileDescription: _
FileVersion: 6.0.0.1111
InternalName: SEM智能下载器.exe
LegalCopyright: Copyright (C) 2021
OriginalFilename: SEM智能下载器.exe
ProductName: SEM智能下载器.exe
Translation: 0x0804 0x04b0

AdWare.Win32.Qjwmonkey.lrt also known as:

How to remove AdWare.Win32.Qjwmonkey.lrt?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.