Categories: Malware

What is “BrowserModifier:Win32/CNNIC!pz”?

The BrowserModifier:Win32/CNNIC!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BrowserModifier:Win32/CNNIC!pz virus can do?

Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine BrowserModifier:Win32/CNNIC!pz?


File Info:
name: B4EEA28BF76543D4091B.mlwpath: /opt/CAPEv2/storage/binaries/bff5795cacf849b5b2a53420b129026b4d1f3007554528926847c55a1a479b04crc32: CA062D31md5: b4eea28bf76543d4091b7844b25b4b1asha1: aa11a1d7926d346cfdc433e83b28ed24f5a00033sha256: bff5795cacf849b5b2a53420b129026b4d1f3007554528926847c55a1a479b04sha512: a3fba5d511d02140d3eba5dfb8cde76044c50faa7d970532c603f6eedca784412a52dd6020b2c55220a9f0be0055026608d9bccc4f428ec3de09b8c49399a17essdeep: 6144:+bFSTsVtM6vNHlk9N9ZAXbBNBa9eBGZlWh8p2aLczMwMEbkRR9rFDHig0u2VDHkU:EoYtMoHl09Z8B+ZlEYOwRR9xHigGktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D38423F4AD70C779E5E514B5A8A7136290C89E7B7658423A73B62F048CF83C9704B1BEsha3_384: 8e4488c207b53d68b09a7ad810dc46e696fef0bd44eaaa032f48ef8dc98ff2ff57a3eacd5b3e8ba4d23964aa51a09ae5ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 2007-05-25 10:05:17
Version Info:
Comments: CompanyName: 中国互联网络信息中心FileDescription: 国际化域名支持FileVersion: 2, 6, 0, 1InternalName: LegalCopyright: Copyright CNNIC 2006 - 2007LegalTrademarks: OriginalFilename: setup.exePrivateBuild: ProductName: ProductVersion: 2, 6, 0, 1SpecialBuild: Translation: 0x0804 0x04b0

BrowserModifier:Win32/CNNIC!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Adware.Win32.Horse.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Horse.CTF
ClamAV	Win.Trojan.Fraudload-9877449-0
FireEye	Trojan.Horse.CTF
Skyhigh	BehavesLike.Win32.Worm.fc
ALYac	Trojan.Horse.CTF
Malwarebytes	MachineLearning/Anomalous.100%
Zillya	Trojan.Genome.Win32.109489
Sangfor	Adware.Win32.Cnnic.V84g
Alibaba	AdWare:Win32/CnsMin.fb3f57c4
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.CBXVXBJ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:AdWare.Win32.CnsMin.ha
BitDefender	Trojan.Horse.CTF
NANO-Antivirus	Trojan.Win32.TrjGen.qmefa
Avast	Win32:Cnnic-D [PUP]
Tencent	Win32.AdWare.Cnsmin.Ssmw
Sophos	CNav (PUA)
F-Secure	Adware.ADSPY/Cdn.B.1
DrWeb	Adware.Cdn
VIPRE	Trojan.Horse.CTF
TrendMicro	TROJ_GEN.R002C0PAN24
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.Horse.CTF (B)
Ikarus	BHO.Win32.CNNIC
Google	Detected
Avira	ADSPY/Cdn.B.1
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	Win32.Troj.BDSearch.gen
Microsoft	BrowserModifier:Win32/CNNIC!pz
Xcitium	ApplicUnwnt.Win32.Adware.Cdn.B`10@1ns3ot
Arcabit	Trojan.Horse.CTF
ZoneAlarm	not-a-virus:AdWare.Win32.CnsMin.ha
GData	Trojan.Horse.CTF
Varist	W32/Adware.HYWG-8133
McAfee	Artemis!B4EEA28BF765
MAX	malware (ai score=100)
VBA32	Adware.Cdn
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0PAN24
Rising	Trojan.Bitrep!8.F596 (CLOUD)
Yandex	Trojan.GenAsa!EwqfwPoyI0A
MaxSecure	Trojan.Malware.1812885.susgen
AVG	Win32:Cnnic-D [PUP]
Cybereason	malicious.7926d3
DeepInstinct	MALICIOUS