Categories: Malware

Downloader.Win32.Agent.mffn (file analysis)

The Downloader.Win32.Agent.mffn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Downloader.Win32.Agent.mffn virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)

Related domains:

w.nanweng.cn

How to determine Downloader.Win32.Agent.mffn?


File Info:
crc32: 9DE6B6DFmd5: 88267fdbb69fc772b55e633384e384e4name: edupep-n8508gs311_16907.exesha1: 8d2cdef48113c52491a02df23feace610e2d6b6asha256: 0a36f6634646b0c900ef1c5fb30f3c86d1c8beb3cb7035c65dfda22c5f5dd8cdsha512: 5f8ad07a6cb7e0c8a6cd33f16f5aa1b4a8aa64a400c19c359e1daaee63df76fe7ffb9b928eeffefe3ff45c98381edc661caae636bd627a9cc5e023921ac47cddssdeep: 24576:n31Y1pidrTOoFeyS140FodGZ5L+/Iw9WBJTgTMp/HnDds:61pi1yT1CdSiNWfZp/HDdstype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2020InternalName: x667ax80fdx4e0bx8f7dx5668.exeFileVersion: 5.0.0.0307ProductName: x667ax80fdx4e0bx8f7dx5668.exeProductVersion: 5.0.0.0307FileDescription: x667ax80fdx4e0bx8f7dx5668OriginalFilename: x667ax80fdx4e0bx8f7dx5668.exeTranslation: 0x0804 0x04b0

Downloader.Win32.Agent.mffn also known as:

MicroWorld-eScan	Gen:Variant.Johnnie.225567
FireEye	Gen:Variant.Graftor.699946
McAfee	Artemis!88267FDBB69F
Sangfor	Malware
K7AntiVirus	Adware ( 005104d01 )
BitDefender	Gen:Variant.Johnnie.225567
K7GW	Adware ( 005104d01 )
Cybereason	malicious.bb69fc
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
Paloalto	generic.ml
GData	Gen:Variant.Johnnie.225567
Kaspersky	not-a-virus:Downloader.Win32.Agent.mffn
Alibaba	Downloader:Win32/Qjwmonkey.cc118687
ViRobot	Adware.Qjwmonkey.1392664
Avast	Win32:Adware-gen [Adw]
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Johnnie.225567 (B)
F-Secure	Adware.ADWARE/AD.QjwMonkey
DrWeb	Adware.Qjwmonkey.168
McAfee-GW-Edition	Artemis!PUP
Sophos	Generic PUA IN (PUA)
Ikarus	PUA.Qjwmonkey
Cyren	W32/Adware.VDZP-6156
Webroot	W32.Adware.Gen
Avira	ADWARE/AD.QjwMonkey.jkrfz
MAX	malware (ai score=99)
Antiy-AVL	GrayWare[AdWare]/Win32.Qjwmonkey
Microsoft	PUA:Win32/Qjwmonkey
Arcabit	Trojan.Johnnie.D3711F
ZoneAlarm	not-a-virus:Downloader.Win32.Agent.mffn
AhnLab-V3	PUP/Win32.Installer.C4011793
VBA32	BScope.Adware.Qjwmonkey
ALYac	Gen:Variant.Johnnie.225567
Ad-Aware	Gen:Variant.Johnnie.225567
Malwarebytes	Adware.ChinAd
ESET-NOD32	a variant of Win32/Adware.Qjwmonkey.H
TrendMicro-HouseCall	TROJ_GEN.R002H0CCC20
Rising	Adware.Downloader!1.BDCA (CLOUD)
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Qjwmonkey.KD!tr
AVG	Win32:Adware-gen [Adw]
Panda	Trj/CI.A