Adware Fake Spy

What is “Win32/Adware.FakeAntiSpy.AN”?

Malware Removal

The Win32/Adware.FakeAntiSpy.AN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Adware.FakeAntiSpy.AN virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Enumerates running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Checks the presence of disk drives in the registry, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Attempts to disable browser security warnings
  • Harvests cookies for information gathering

How to determine Win32/Adware.FakeAntiSpy.AN?


File Info:

name: 354B0E3D4781CA16DFF1.mlw
path: /opt/CAPEv2/storage/binaries/0a662df45729c5647ab73139f0bc5fc5231d2f3b98c382b1317b2277d8ef5a9f
crc32: 58090B19
md5: 354b0e3d4781ca16dff1b6a4e761a17b
sha1: a9832d949b6faf4f2d4f6964d442452b1e17ea36
sha256: 0a662df45729c5647ab73139f0bc5fc5231d2f3b98c382b1317b2277d8ef5a9f
sha512: 069bbdcd7c185a621bca668e19acf77c1f1017a2f437575ba3a3608b22b68634bc0a4c274b7be433d376deab5325f3208aedde5a2c1db08119097fce9f7e1dcd
ssdeep: 12288:EQIfqOiX9P/aazd1ctyDXHrJW2dGMToCRn5VxWRaqsrOkqgyQD9:EQIydX/d1rTLRd/TvVUsrOkqFQD9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D6F41267F7A7386AE5E67CF00542AB614271FC6ED6939A56BA7CBA47943C403CE0130C
sha3_384: 2bf1c2066321cdfe37787f99441a8d64be0a8e57932b3a56e6c10b42eec4463be7e32f31afa6ce8c329a8f4301dd60c8
ep_bytes: 60be00304e008dbe00e0f1ffc787bc87
timestamp: 2011-05-02 21:13:07

Version Info:

0: [No Data]

Win32/Adware.FakeAntiSpy.AN also known as:

CynetMalicious (score: 100)
McAfeeFakeAV-PJ.gen.n
CylanceUnsafe
ZillyaTrojan.FakeAV.Win32.61062
K7AntiVirusTrojan ( 0025360d1 )
K7GWTrojan ( 0025360d1 )
Cybereasonmalicious.d4781c
CyrenW32/A-8c58d75e!Eldorado
ESET-NOD32a variant of Win32/Adware.FakeAntiSpy.AN
APEXMalicious
AvastWin32:Delf-PCL [Trj]
ClamAVWin.Trojan.Fakeav-57357
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Ursu.490406
NANO-AntivirusTrojan.Win32.Fakealert.cskye
MicroWorld-eScanGen:Variant.Ursu.490406
Ad-AwareGen:Variant.Ursu.490406
SophosMal/FakeAV-CZ
DrWebTrojan.AVKill.9500
VIPREFraudTool.Win32.CleanThis (v)
McAfee-GW-EditionFakeAV-PJ.gen.n
FireEyeGeneric.mg.354b0e3d4781ca16
EmsisoftGen:Variant.Ursu.490406 (B)
IkarusTrojan.Fakeav
GDataGen:Variant.Ursu.490406
JiangminTrojan/Fakeav.alfk
AviraTR/FakeAV.CT.4
Antiy-AVLTrojan/Generic.ASMalwS.914AA7
ArcabitTrojan.Ursu.D77BA6
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
AhnLab-V3Trojan/Win32.FakeAV.R5954
VBA32TScope.Trojan.Delf
ALYacGen:Variant.Ursu.490406
MAXmalware (ai score=83)
YandexTrojan.GenAsa!xHKCKGJtv24
BitDefenderThetaGen:NN.ZelphiF.34062.SmJfaqiTlPik
AVGWin32:Delf-PCL [Trj]
MaxSecureTrojan.Malware.2081331.susgen

How to remove Win32/Adware.FakeAntiSpy.AN?

Win32/Adware.FakeAntiSpy.AN removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment