home

f_000057

Downloader

Anhui Haiyang Software Technology Co., Ltd.

The file f_000057 by Anhui Haiyang Software Technology Co. has been detected as a potentially unwanted program by 21 anti-malware scanners. The file has been seen being downloaded from xiazai.zol.com.cn and multiple other hosts.
Publisher:
Anhui Haiyang Software Technology Co., Ltd.  (signed and verified)

Product:
Downloader

Version:
6.6.6.12

MD5:
d60179767640477c8b47d61df6b289f9

SHA-1:
e6a5b5fb0519e5f7d11dea4c978f2b23ac778dab

SHA-256:
ac2c409713c32eb0ed6bd1040bf4a48e7125589a923babf4e9f736178817aebc

Scanner detections:
21 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 1:35:24 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Qjwmonkey
7.1.1

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.08.20

Avira AntiVirus
APPL/Qjwmonkey.uzfd
8.3.1.6

avast!
Win32:Adware-gen [Adw]
2014.9-150820

AVG
Generic6
2016.0.3012

Clam AntiVirus
Win.Adware.Multiplug-48491
0.98/21511

Dr.Web
Adware.Qjwmonkey.34
9.0.1.0232

ESET NOD32
Win32/Adware.Qjwmonkey (variant)
9.12121

Fortinet FortiGate
Riskware/BindEx
8/20/2015

F-Prot
W32/S-d0ebbc77
v6.4.7.1.166

G Data
Win32.Trojan.Agent.AU7HNT
15.8.25

IKARUS anti.virus
not-a-virus:Downloader.BindEx
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.2016943

Kaspersky
not-a-virus:Downloader.Win32.BindEx
14.0.0.1554

McAfee
PUP-FXI
5600.6668

NANO AntiVirus
Riskware.Win32.Qjwmonkey.duatit
0.30.24.3079

Panda Antivirus
Trj/Genetic.gen
15.08.20.06

Rising Antivirus
PE:Trojan.Win32.Generic.18F7D0C5!418894021
23.00.65.15818

Sophos
Generic PUA OG (PUA)
4.98

VIPRE Antivirus
Trojan.Win32.Generic
43040

Zillya! Antivirus
Adware.Qjwmonkey.Win32.17
2.0.0.2361

File size:
667.6 KB (683,600 bytes)

Product version:
6.6.6.12

Original file name:
Downloader

Language:
Chinese

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\temp\webkit\cache\f_000057

Digital Signature
Signed by:
Anhui Haiyang Software Technology Co., Ltd.

Authority:
WoSign CA Limited

Valid from:
7/10/2015 4:14:53 AM

Valid to:
7/10/2016 4:14:53 AM

Subject:
CN="Anhui Haiyang Software Technology Co., Ltd.", O="Anhui Haiyang Software Technology Co., Ltd.", L=Maanshan, S=Anhui, C=CN

Issuer:
CN=WoSign Class 3 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
637FE8CBCA34EB8FB234CB27C57E0275

File PE Metadata
Compilation timestamp:
7/9/2015 12:52:26 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:AQwV+ak+cxZkZj5jmqSH46hxnkNUNZyFE+Oldk:A+36ZVjmdH1xnkNU4E+Olu

Entry address:
0x164DB

Entry point:
E8, 69, 86, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 7F, 0F, B6, 44, 24, 08, 0F, BA, 25, 50, A5, 48, 00, 01, 73, 0D, 8B, 4C, 24, 0C, 57, 8B, 7C, 24, 08, F3, AA, EB, 5D, 8B, 54, 24, 0C, 81, FA, 80, 00, 00, 00, 7C, 0E, 0F, BA, 25, 1C, 8A, 43, 00, 01, 0F, 82, 48, 88, 00, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C, 2B, D1, 88, 07, 83, C7, 01, 83, E9, 01, 75, F6, 8B, C8, C1, E0, 08, 03, C1, 8B, C8, C1, E0, 10, 03, C1...
 
[+]

Code size:
168.5 KB (172,544 bytes)

The file f_000057 has been seen being distributed by the following 12 URLs.

http://xiazai.zol.com.cn/down.php?nn=9953f6277e788d76f&softid=41752&subcateid=279&site=10b&server=10&rand=4676751

http://xiazai.zol.com.cn/down.php?nn=6828fb163e99d74dd&softid=50184&subcateid=726&site=10&server=10&rand=1667642

http://xiazai.zol.com.cn/down.php?nn=3517d533c8cb51b79&softid=381627&subcateid=103&site=10&server=10&rand=5039831

http://www.52z.com/.../down?appid=13&id=127181

http://xiazai.zol.com.cn/down.php?nn=5e8126d7ab0751e5e&softid=430239&subcateid=69&site=10&server=10&rand=7545637

http://url.perday.org/.../Microsof excel 2010 ?????_Microsoft Office Excel 2010@67_91465.exe

http://xiazai.zol.com.cn/down.php?nn=2791582766314787f&softid=101210&subcateid=345&site=10&server=10&rand=2535979

http://xiazai.zol.com.cn/down.php?nn=23001e1729afe594e&softid=406930&subcateid=1444&site=10&server=10&rand=8533101

http://www.skycn.com/?m=downloader&id=5408

http://xiazai.zol.com.cn/down.php?nn=bc29f4c14ea51514c&softid=135373&subcateid=327&site=10&server=10&rand=8073343

http://xiazai.zol.com.cn/down.php?nn=bc29f4c14ea51514c&softid=135373&subcateid=327&site=10&server=10&rand=44763

http://xiazai.zol.com.cn/down.php?nn=0ad70be0b91c9be8b&softid=196587&subcateid=279&site=10&server=10&rand=1554133

Remove f_000057 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.