home

jtzauezwv.exe

Crime Watch

Mathematical Applications

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser. Part of the Injekt brand of unwanted programs. The application jtzauezwv.exe by Mathematical Applications has been detected as adware by 15 anti-malware scanners. According to AVG, this software downloads additional adware offers during setup.
Publisher:
Mathematical Applications  (signed and verified)

Product:
Crime Watch

Description:
CrimeWatch

Version:
1.0.0.0

MD5:
cbcb6d426e1e6497c0d3a1b483a57136

SHA-1:
835cdaf61f9bc118b894c4be1489d214d01bb3be

SHA-256:
e63035326b97c8499881e404d8260a2048e5c858716de8df0ce621da8c8b8b40

Scanner detections:
15 / 68

Status:
Adware

Explanation:
Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:
4/26/2024 10:35:43 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Jatif.92
734

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.206.0

avast!
MSIL:Adware-G [PUP]
2014.9-150201

AVG
Downloader
2016.0.3212

Baidu Antivirus
Adware.MSIL.PullUpdate
4.0.3.1521

Bitdefender
Gen:Variant.Adware.Jatif.92
1.0.20.160

Dr.Web
Adware.Yontoo.55
9.0.1.032

Emsisoft Anti-Malware
Gen:Variant.Adware.Jatif.92
8.15.02.01.05

ESET NOD32
MSIL/Adware.PullUpdate.G.gen (variant)
9.11099

F-Secure
Gen:Variant.Adware.Jatif.92
11.2015-01-02_1

G Data
Gen:Variant.Adware.Jatif.92
15.2.25

Malwarebytes
PUP.Optional.CrimeWatch.A
v2015.02.01.05

MicroWorld eScan
Gen:Variant.Adware.Jatif.92
16.0.0.96

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Injekt
15.2.1.5

File size:
47.3 KB (48,400 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © Mathematical Applications 2015

Original file name:
CrimeWatch.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\ProgramData\ogblcop\dat\jtzauezwv.exe

Digital Signature
Signed by:
Mathematical Applications

Authority:
VeriSign, Inc.

Valid from:
10/27/2014 1:00:00 AM

Valid to:
10/28/2015 12:59:59 AM

Subject:
CN=Mathematical Applications, O=Mathematical Applications, L=St. James, S=St. James, C=BB

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
79F6406432970C77D2FA7772E5EB6BDC

File PE Metadata
Compilation timestamp:
1/29/2015 6:13:30 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:VnqQDSPh1AsTjQmFMpQOtNhhQW7COvS+cdWuFMcUucEePzsljFigSwQ1:Vn27pXxfOL0OvRBzKHfjEjl

Entry address:
0xB83E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
38.5 KB (39,424 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-52-16-174-255.eu-west-1.compute.amazonaws.com  (52.16.174.255:80)

TCP (HTTP):
Connects to ec2-54-76-91-10.eu-west-1.compute.amazonaws.com  (54.76.91.10:80)

TCP (HTTP):
Connects to ec2-54-171-43-206.eu-west-1.compute.amazonaws.com  (54.171.43.206:80)

Remove jtzauezwv.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.