Adware

Win32/Adware.Hebchengjiu.C removal

Malware Removal

The Win32/Adware.Hebchengjiu.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Adware.Hebchengjiu.C virus can do?

  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Attempts to modify browser security settings
  • Creates a copy of itself
  • Deletes executed files from disk
  • Harvests cookies for information gathering

How to determine Win32/Adware.Hebchengjiu.C?


File Info:

name: A07FCB0976483D86BC91.mlw
path: /opt/CAPEv2/storage/binaries/f5bd2b7aa017d44bafe1ff5e04d8efb935d529303e079b9111b2067ddaaaf94f
crc32: 1277340F
md5: a07fcb0976483d86bc914b2e3ba7c0d1
sha1: 177451a98585bd26d660e48c52ff36e36ca96989
sha256: f5bd2b7aa017d44bafe1ff5e04d8efb935d529303e079b9111b2067ddaaaf94f
sha512: a10a38b3465a8818359b260c52c1574019008217a78128d87c3949fe4efba2a52a93b00bdece5de40605c4474c55e94088dca7bf5c7b7f5af8e0156861a994be
ssdeep: 24576:tDTk5JPgslAt8lPivBbm5iNS4l5MmS946+oo5c4MR9eLpK4DINdR:ttiT4U46Ic4MRsbDINdR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T156855963A35180F0D69A013197BA633C6478BB620D35EF63FBC9DEA45C217D1EE1622D
sha3_384: f91f3c4b2dd1b515c9a550d8bcb5d9488e99cccc748fc1d0435139a4152341ce9fc347f2a3cec1b6247a4667919f6f62
ep_bytes: 558bec6aff6880f34500682065450064
timestamp: 2016-07-13 04:29:44

Version Info:

FileVersion: 1.7.0.0
FileDescription:
ProductName:
ProductVersion: 1.7.0.0
CompanyName:
LegalCopyright:
Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
Translation: 0x0804 0x04b0

Win32/Adware.Hebchengjiu.C also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Doina.7153
FireEyeGeneric.mg.a07fcb0976483d86
CAT-QuickHealTrojan.Mauvaise.SL1
McAfeeGenericR-IGK!A07FCB097648
CylanceUnsafe
VIPREGen:Variant.Doina.7153
SangforTrojan.Win32.Save.BlackMoon
K7AntiVirusTrojan ( 005328801 )
K7GWTrojan ( 005328801 )
Cybereasonmalicious.976483
BitDefenderThetaGen:NN.ZexaF.34682.Tr1@aqDsbTab
CyrenW32/S-ac231ef0!Eldorado
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/Adware.Hebchengjiu.C
ClamAVWin.Dropper.Tiggre-9845940-0
Kasperskynot-a-virus:HEUR:AdWare.Win32.Generic
BitDefenderGen:Variant.Doina.7153
NANO-AntivirusRiskware.Win32.MlwGen.eivdbr
CynetMalicious (score: 100)
APEXMalicious
RisingDownloader.Generic!8.141 (TFE:5:7LXjXuuHuaJ)
Ad-AwareGen:Variant.Doina.7153
EmsisoftGen:Variant.Doina.7153 (B)
ComodoApplication.Win32.AdWare.Hebchengjiu.C@72jdii
DrWebTrojan.Siggen7.8518
ZillyaAdware.Hebchengjiu.Win32.29
McAfee-GW-EditionBehavesLike.Win32.CoinMiner.th
Trapminemalicious.high.ml.score
SophosBlackMoon Packed (PUA)
IkarusTrojan.Win32.Tonmye
GDataWin32.Application.PUPStudio.B
JiangminAdWare.Generic.cnsn
AviraTR/ATRAPS.Gen7
MAXmalware (ai score=81)
Antiy-AVLTrojan/Generic.ASCommon.FA
ArcabitTrojan.Doina.D1BF1
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
VBA32BScope.Adware.AdLoad
ALYacGen:Variant.Doina.7153
MalwarebytesUpatre.Trojan.Downloader.DDS
AvastWin32:Adware-gen [Adw]
TencentAdware.Win32.Hebchengjiu.16000480
YandexTrojan.GenAsa!5Vn07DYbtSY
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/CoinMiner.WP!tr
AVGWin32:Adware-gen [Adw]
PandaTrj/Genetic.gen

How to remove Win32/Adware.Hebchengjiu.C?

Win32/Adware.Hebchengjiu.C removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment