About “PUAAdvertising:Win32/Qjwmonkey” infection

The PUAAdvertising:Win32/Qjwmonkey is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUAAdvertising:Win32/Qjwmonkey virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine PUAAdvertising:Win32/Qjwmonkey?

File Info:
name: FD225486CFB6EB59FB3B.mlw
path: /opt/CAPEv2/storage/binaries/c84b7b875cfaff8b5caff54208b4b3d5fe5526cd55b2bc7631c67b2f7cb3bc25
crc32: BB4BF156
md5: fd225486cfb6eb59fb3bd04539610bd0
sha1: 062f4d1aec896677153a604764997a27018ad8c6
sha256: c84b7b875cfaff8b5caff54208b4b3d5fe5526cd55b2bc7631c67b2f7cb3bc25
sha512: bc6fb370af310d5b15dd95cb77cca8aef65e80af0bf4e52d323ee0c230c22911fb25e9884d53189ae76f75c5f850a1f7eb25f2241559b5f240e2d460f059ad7b
ssdeep: 12288:MC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspj:MC6wp1vfhboOb66Uyavk8hdo+g8BOONO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T110E42331E9E94801F11BCD377921C6B224A8FC44D3D5920E67DCBF27ABBA6145138B6E
sha3_384: 75e84e43850abeb9b9d77d865bb923cd29282eb0163d22fa2712c32e31728111d3a69fa58c51ff4a1cb037e0e356055e
ep_bytes: 60be00d050008dbe0040efffc787a461
timestamp: 2021-11-11 11:21:42

Version Info:
FileDescription: _
FileVersion: 6.0.0.1111
InternalName: SEM智能下载器.exe
LegalCopyright: Copyright (C) 2021
OriginalFilename: SEM智能下载器.exe
ProductName: SEM智能下载器.exe
Translation: 0x0804 0x04b0

PUAAdvertising:Win32/Qjwmonkey also known as:

How to remove PUAAdvertising:Win32/Qjwmonkey?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.