{8d075910-3332-4e1b-83a0-de523a191c04}w.sys
Skywebber
Part of the Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The file {8d075910-3332-4e1b-83a0-de523a191c04}w.sys by Skywebber has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a Windows 64-bit kernel mode device driver named “{8d075910-3332-4e1b-83a0-de523a191c04}w”.
File name:
{8d075910-3332-4e1b-83a0-de523a191c04}w.sys
Publisher:
StdLib (signed by Skywebber)
Version:
1.4.3.1 built by: WinDDK
MD5:
b8617f11652a3a708c69cb852e5fb456
SHA-1:
b78f81f77c1a2c6e45e5c5aa39b6030b22ad809c
SHA-256:
cb746689afa457b3b9885611fbafb5a55f061c71d746fb0353661ae621b2e56b
Scanner detections:
1 / 68
Explanation:
Belongs to the Sambreel/Yontoo progam that inserts various forms of advertising in the user's web browser, installed with minimal or no user consent.
Analysis date:
4/27/2024 12:13:44 AM UTC (today)
Scan engine
Detection
Engine version
Reason Heuristics
PUP.Skywebber.k
14.8.8.0
File size:
51.7 KB (52,920 bytes)
Copyright:
Copyright © 2013 StdLib
Original file name:
StdLib.sys
File type:
Driver (Win64 SYS)
Language:
English (United States)
Common path:
C:\Windows\System32\drivers\{8d075910-3332-4e1b-83a0-de523a191c04}w.sys
Valid from:
10/7/2013 3:00:00 AM
Valid to:
10/8/2014 2:59:59 AM
Subject:
CN=Skywebber, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Skywebber, L=San Diego, S=California, C=US
Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Serial number:
06606AB25DD3CD2FC4C1610240BD0EF8
CTPH (ssdeep):
768:kIsHpnKHCBSqUPJHKQpkJxpKwT2bcWiJmOtX3g2rp3lnHE5:jsHRKHLJqQpkYwTsiTtXxtk5
Driver
Display name:
{8d075910-3332-4e1b-83a0-de523a191c04}w
Type:
Kernel device driver (KernelDriver)