home

{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys

NetCrawl

Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The file {6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys by NetCrawl has been detected as adware by 11 anti-malware scanners. It runs as a Windows 64-bit kernel mode device driver named “{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64”. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages.
Publisher:
StdLib  (signed by NetCrawl)

Product:
StdLib

Version:
1.4.3.1 built by: WinDDK

MD5:
4f8958ad950bdabc0248805cbc94962d

SHA-1:
322f4e71f9d01c7879035cc79cb587889a896c5c

SHA-256:
99dc701969bfd287833ddabdea17b55d882913dbb70ce8bf55f29c8cc1ae00a0

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
4/26/2024 2:24:58 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.BPlug
7.1.1

AVG
NetCrawl
2015.0.3374

Baidu Antivirus
Adware.Win32.BrowseFox
4.0.3.14822

Dr.Web
Trojan.BPlug.123
9.0.1.05190

IKARUS anti.virus
AdWare.SpadeCast
t3scan.1.6.1.0

McAfee
Artemis!D2890F009BF4
5600.7030

Reason Heuristics
PUP.NetCrawl.m
14.8.22.17

Sophos
BrowseSmart
4.98

Trend Micro House Call
Suspicious_GEN.F47V0701
7.2.234

VIPRE Antivirus
Trojan.Win32.Generic
31766

Zillya! Antivirus
Adware.Yotoon.Win64.3
2.0.0.1899

File size:
59.7 KB (61,112 bytes)

Product version:
1.4.3.1

Copyright:
Copyright © 2013 StdLib

Original file name:
StdLib.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys

Digital Signature
Signed by:
NetCrawl

Authority:
VeriSign, Inc.

Valid from:
4/28/2014 8:00:00 PM

Valid to:
4/29/2015 7:59:59 PM

Subject:
CN=NetCrawl, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=NetCrawl, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3C05F8D25EB72CD5B6EB863AA0585F70

File PE Metadata
Compilation timestamp:
8/6/2014 7:52:18 PM

OS version:
6.1

OS bitness:
Win64

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
768:Lot2dxF9O8ZF33iqiIy9387Hp9XcfBzSowidIOf:L9JRicy938Lp9eW1j6

Entry address:
0xF064

Entry point:
48, 83, EC, 28, 4C, 8B, C2, 4C, 8B, C9, E8, 95, FF, FF, FF, 49, 8B, D0, 49, 8B, C9, 48, 83, C4, 28, E9, 2E, 20, FF, FF, CC, CC, 38, F2, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 1C, F6, 00, 00, 60, C1, 00, 00, 28, F1, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, BE, F9, 00, 00, 50, C0, 00, 00, D8, F0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B6, FA, 00, 00, 00, C0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 9A, FA, 00, 00, 00, 00, 00, 00, 86, FA, 00, 00...
 
[+]

Entropy:
5.9524

Code size:
46.5 KB (47,616 bytes)

Driver
Display name:
{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.