What is “Win32:Jadtre-H [Rtk]”?

The Win32:Jadtre-H [Rtk] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Jadtre-H [Rtk] virus can do?

• Sample contains Overlay data
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Binary file triggered YARA rule
• Anomalous binary characteristics

How to determine Win32:Jadtre-H [Rtk]?

File Info:
name: 9BF9BA08B261D9C86536.mlw
path: /opt/CAPEv2/storage/binaries/245eb3e645b4a42d0458fb887d3248a79ccac898afc741b2cc9e7a8398b0d3ee
crc32: 87BFABC1
md5: 9bf9ba08b261d9c8653672dc44359f00
sha1: 0efed9014ebdccf7689415e19632d0df1e313428
sha256: 245eb3e645b4a42d0458fb887d3248a79ccac898afc741b2cc9e7a8398b0d3ee
sha512: 38cc27a60ee26808cd4bd3347a9d8413813ca38d3269a2693798a37b4a87bd1ecf8b7c00a3f7dc1f7230f2ee7e9e423405a521fe42343189be19e69cb456be16
ssdeep: 1536:QuDAfCsBfLLyIq/eFlPUUdAppobLIliYc0fwFa5wA/9iKKbkgNF:L8KsBfL2//eFlc0bL34wF4LAXbkgNF
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T15CD39DB65580B07BC06A013215229BAF6EEA6F7B05349C0FC7946E6937FE6DBD230117
sha3_384: 8610973e916c1e3b07110e2fbdf3362c129d6233c2a7929faf7e054ab59af9351c06c1d248a1b78fd3fb794e1bb84013
ep_bytes: 558bec81ec5404000056578365f80083
timestamp: 2010-05-26 17:01:02

Version Info:
CompanyName: Shenzhen QVOD Technology Co.,Ltd
FileDescription: QvodInstall Module
FileVersion: 3, 0, 0, 0
InternalName: QvodInstall.exe
LegalCopyright: Copyright(C) 2006-2009 QVOD
OriginalFilename: QvodInstall.exe
ProductName: QvodInstall Module
ProductVersion: 3, 0, 0, 0
Translation: 0x0409 0x04b0

Win32:Jadtre-H [Rtk] also known as:

How to remove Win32:Jadtre-H [Rtk]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.