A quick tutorial on ClamAV detection: Win.Adware.Bprotector
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | 0039bd936a34b4443f2c476212680238 | 0EF9CCBF085C8FECCF46D194AF 788BB0287D7427E617F37E58F7A6305D 0039BD936A34B4443F2C476212680238 |
| md5 | 00b74003300fd5800017089f396541b3 | 405C2D3A73120525B46F84F6F6 5D89FC0BAD2091434ACB753105C4FE44 00B74003300FD5800017089F396541B3 B0709680A86BDD99F968752C9449B809 E66E725E10B9CB8A6F5C74D7CA |
| md5 | 057b060105b32f76dec9e0104fa44d20 | DC26FF08A62CEFB4CA13A90C23 22DC493C1376810FD641E1047CEC4C74 057B060105B32F76DEC9E0104FA44D20 B8EA863D5058214DE53E3927A8EA6A2F D57D8DCA47572B7E75226202C9 |
| md5 | 05a7de0ef9ccbf085c8feccf46d194af | A44BAA3CE203D6E5D853207821 D8C76AFC1A8BD39E0DA3A8DBE2F1DD90 05A7DE0EF9CCBF085C8FECCF46D194AF 788BB0287D7427E617F37E58F7A6305D 0039BD936A34B4443F2C476212 |
| md5 | 08627677f0b8e6dc45f20e694a56f959 | 80A86BDD99F968752C9449B809 E66E725E10B9CB8A6F5C74D7CA9E98A9 08627677F0B8E6DC45F20E694A56F959 4704AB98EA625318627CC140EA0A64B0 BE8B003258597F7EEFD8F71D34 |
| md5 | 0b403bdc26ff08a62cefb4ca13a90c23 | A357A412F6FA7A3E4F78E723CB 867D609BBA4CE0F489956F0B4EB408A7 0B403BDC26FF08A62CEFB4CA13A90C23 22DC493C1376810FD641E1047CEC4C74 057B060105B32F76DEC9E0104F |
| md5 | 0dfc013e5220a5e04f227f26fb4cbdcb | 41ADD2AD9513F4EE93640369C7 C57E74F17A81F4120728E1E9EC89974A 0DFC013E5220A5E04F227F26FB4CBDCB BF55ADBAFB776827C77CDC039DB4A289 E167C50E69261A944AEED01BE8 |
| md5 | 0f8dbc492e31b568ac5f713e29bfb996 | A4E5565D2355115E54EEF78757 D88018E7E59732416A8295D3E5C58723 0F8DBC492E31B568AC5F713E29BFB996 A38555B76113A3A8D7CB871C1E3EC071 FAFAC7F1057B45EAF0B7D08EBC |
| md5 | 16b9773acbd0ee27f63b0708f403be09 | 2485A85FFA2D308377567D0DD8 45ACFF26233B3B46BC5B2B5453DCB417 16B9773ACBD0EE27F63B0708F403BE09 F253E8405C2D3A73120525B46F84F6F6 5D89FC0BAD2091434ACB753105 |
| md5 | 1a67c23252952ad0e35f4e2e77b64369 | B7D9AF4F02A8C4D8070452B7F9 2843847375BB1B97AE7883242A0E8431 1A67C23252952AD0E35F4E2E77B64369 4FC6464E3CE7C68A4971E8E0EB076299 3E8D43DE575690DE1079C6F9D0 |
| md5 | 1aa1654f7d8150ceb95ff3247a395658 | 7D23420C4285C3E23D61F310C2 898E19C222E4D0A069C0B0CE0CED82FF 1AA1654F7D8150CEB95FF3247A395658 B60EC08912ADC27717029DC7BB1DA9F5 B2FE30198633E997AC0434085A |
| md5 | 22dc493c1376810fd641e1047cec4c74 | 9BBA4CE0F489956F0B4EB408A7 0B403BDC26FF08A62CEFB4CA13A90C23 22DC493C1376810FD641E1047CEC4C74 057B060105B32F76DEC9E0104FA44D20 B8EA863D5058214DE53E3927A8 |
| md5 | 2403010c49c5cf46be3a7d9f11e6c7c3 | 3F92ED1C60648948B3015F6662 F5EBF33C3F8B1C0BF6BC40935EB150B8 2403010C49C5CF46BE3A7D9F11E6C7C3 E782B3FF0987095995AF63A6C8681798 9A22211132C5CA3201A4CF2EE2 |
| md5 | 26b9f2798692698d333169220f00c604 | EFF38160C42DCF76F754D7CD47 36D2E04FA937C97E5E0990B4D8A3DFFE 26B9F2798692698D333169220F00C604 5D8820244C37CB26E92001C41BF559D8 7537F941ADD2AD9513F4EE9364 |
| md5 | 27db483f92ed1c60648948b3015f6662 | 3D5058214DE53E3927A8EA6A2F D57D8DCA47572B7E75226202C96BCA12 27DB483F92ED1C60648948B3015F6662 F5EBF33C3F8B1C0BF6BC40935EB150B8 2403010C49C5CF46BE3A7D9F11 |
| md5 | 2843847375bb1b97ae7883242a0e8431 | DEA9E4D177535571E7BAB86063 FE1481B7D9AF4F02A8C4D8070452B7F9 2843847375BB1B97AE7883242A0E8431 1A67C23252952AD0E35F4E2E77B64369 4FC6464E3CE7C68A4971E8E0EB |
| md5 | 36d2e04fa937c97e5e0990b4d8a3dffe | DE575690DE1079C6F9D0A585DE ABF46DEFF38160C42DCF76F754D7CD47 36D2E04FA937C97E5E0990B4D8A3DFFE 26B9F2798692698D333169220F00C604 5D8820244C37CB26E92001C41B |
| md5 | 3e8d43de575690de1079c6f9d0a585de | 3252952AD0E35F4E2E77B64369 4FC6464E3CE7C68A4971E8E0EB076299 3E8D43DE575690DE1079C6F9D0A585DE ABF46DEFF38160C42DCF76F754D7CD47 36D2E04FA937C97E5E0990B4D8 |
| md5 | 3f6db3a4e5565d2355115e54eef78757 | 27A2E104A6367AA557F3CCEEF9 6314E99350AEB8E61EB46025C3A21F05 3F6DB3A4E5565D2355115E54EEF78757 D88018E7E59732416A8295D3E5C58723 0F8DBC492E31B568AC5F713E29 |
| md5 | 3fc0367d23420c4285c3e23d61f310c2 | B76113A3A8D7CB871C1E3EC071 FAFAC7F1057B45EAF0B7D08EBC9CC251 3FC0367D23420C4285C3E23D61F310C2 898E19C222E4D0A069C0B0CE0CED82FF 1AA1654F7D8150CEB95FF3247A |
| md5 | 45acff26233b3b46bc5b2b5453dcb417 | 1DC7AF57BA1A93F9F72848E9BC 5EB4E02485A85FFA2D308377567D0DD8 45ACFF26233B3B46BC5B2B5453DCB417 16B9773ACBD0EE27F63B0708F403BE09 F253E8405C2D3A73120525B46F |
| md5 | 4704ab98ea625318627cc140ea0a64b0 | 5E10B9CB8A6F5C74D7CA9E98A9 08627677F0B8E6DC45F20E694A56F959 4704AB98EA625318627CC140EA0A64B0 BE8B003258597F7EEFD8F71D34C8F3C9 9BE809CCE1B19D28B6D446F246 |
| md5 | 47bf121dc7af57ba1a93f9f72848e9bc | BAFB776827C77CDC039DB4A289 E167C50E69261A944AEED01BE899F5B6 47BF121DC7AF57BA1A93F9F72848E9BC 5EB4E02485A85FFA2D308377567D0DD8 45ACFF26233B3B46BC5B2B5453 |
| md5 | 4de9a05a6bcfcd1a3d0fce79f79c3f3d | the signature alerted on: 96009E8A9CE4285305AFBB61DB1079AC 4DE9A05A6BCFCD1A3D0FCE79F79C3F3D E7BFA025CBBDB414A15F22562E948B56 D474B4DD44329253157E866BB2 |
| md5 | 4fc6464e3ce7c68a4971e8e0eb076299 | 7375BB1B97AE7883242A0E8431 1A67C23252952AD0E35F4E2E77B64369 4FC6464E3CE7C68A4971E8E0EB076299 3E8D43DE575690DE1079C6F9D0A585DE ABF46DEFF38160C42DCF76F754 |
| md5 | 5d5d71dc91ba566d2e5689cb732e415e | C968AD35AF5352D3ED6D50DD1D E7639363693106FC37B19AA428BDD9E6 5D5D71DC91BA566D2E5689CB732E415E BBE8F648B627F828F11B559D14C0840C F6686D4589E352BEB2BCAF7EB8 |
| md5 | 5d8820244c37cb26e92001c41bf559d8 | 4FA937C97E5E0990B4D8A3DFFE 26B9F2798692698D333169220F00C604 5D8820244C37CB26E92001C41BF559D8 7537F941ADD2AD9513F4EE93640369C7 C57E74F17A81F4120728E1E9EC |
| md5 | 5d89fc0bad2091434acb753105c4fe44 | 3ACBD0EE27F63B0708F403BE09 F253E8405C2D3A73120525B46F84F6F6 5D89FC0BAD2091434ACB753105C4FE44 00B74003300FD5800017089F396541B3 B0709680A86BDD99F968752C94 |
| md5 | 5eb4e02485a85ffa2d308377567d0dd8 | 0E69261A944AEED01BE899F5B6 47BF121DC7AF57BA1A93F9F72848E9BC 5EB4E02485A85FFA2D308377567D0DD8 45ACFF26233B3B46BC5B2B5453DCB417 16B9773ACBD0EE27F63B0708F4 |
| md5 | 6314e99350aeb8e61eb46025c3a21f05 | 1132C5CA3201A4CF2EE28B5352 70920727A2E104A6367AA557F3CCEEF9 6314E99350AEB8E61EB46025C3A21F05 3F6DB3A4E5565D2355115E54EEF78757 D88018E7E59732416A8295D3E5 |
| md5 | 6511f0082583111615f49727a4edf92b | 3258597F7EEFD8F71D34C8F3C9 9BE809CCE1B19D28B6D446F2462F32E8 6511F0082583111615F49727A4EDF92B F86BBEA440AEE38F212EEFDA817FB4CC 9E00E3C8092A84A8FA56B628EA |
| md5 | 70920727a2e104a6367aa557f3cceef9 | FF0987095995AF63A6C8681798 9A22211132C5CA3201A4CF2EE28B5352 70920727A2E104A6367AA557F3CCEEF9 6314E99350AEB8E61EB46025C3A21F05 3F6DB3A4E5565D2355115E54EE |
| md5 | 7537f941add2ad9513f4ee93640369c7 | 798692698D333169220F00C604 5D8820244C37CB26E92001C41BF559D8 7537F941ADD2AD9513F4EE93640369C7 C57E74F17A81F4120728E1E9EC89974A 0DFC013E5220A5E04F227F26FB |
| md5 | 76c348d6c05cfb877ce4c57193a615d7 | 25CBBDB414A15F22562E948B56 D474B4DD44329253157E866BB2E8E460 76C348D6C05CFB877CE4C57193A615D7 EAB502723A6CB047F447D2A9FF1BA994 D620AADEA9E4D177535571E7BA |
| md5 | 77eb5b3d855b6a81a55a72432803cb67 | E13B9176477EEECF8D679BA55F C62D6B9F68A19E7FCED9DACE97ADD11A 77EB5B3D855B6A81A55A72432803CB67 A77849BEA22B7A534963CA85AAF82FC8 D658542AEB3A7E304DA20FD820 |
| md5 | 788bb0287d7427e617f37e58f7a6305d | FC1A8BD39E0DA3A8DBE2F1DD90 05A7DE0EF9CCBF085C8FECCF46D194AF 788BB0287D7427E617F37E58F7A6305D 0039BD936A34B4443F2C476212680238 |
| md5 | 7deecba357a412f6fa7a3e4f78e723cb | 6EB16FF998881A18B12779175E 8200F536D57C98CACABB51B56DE7AFB3 7DEECBA357A412F6FA7A3E4F78E723CB 867D609BBA4CE0F489956F0B4EB408A7 0B403BDC26FF08A62CEFB4CA13 |
| md5 | 8200f536d57c98cacabb51b56de7afb3 | 70DCB4A6E7B6B71D9C2D15302B 85F4E36EB16FF998881A18B12779175E 8200F536D57C98CACABB51B56DE7AFB3 7DEECBA357A412F6FA7A3E4F78E723CB 867D609BBA4CE0F489956F0B4E |
| md5 | 85f4e36eb16ff998881a18b12779175e | 2D5AF40B07718C3E10DCB5F975 CE120870DCB4A6E7B6B71D9C2D15302B 85F4E36EB16FF998881A18B12779175E 8200F536D57C98CACABB51B56DE7AFB3 7DEECBA357A412F6FA7A3E4F78 |
| md5 | 867d609bba4ce0f489956f0b4eb408a7 | 36D57C98CACABB51B56DE7AFB3 7DEECBA357A412F6FA7A3E4F78E723CB 867D609BBA4CE0F489956F0B4EB408A7 0B403BDC26FF08A62CEFB4CA13A90C23 22DC493C1376810FD641E1047C |
| md5 | 898e19c222e4d0a069c0b0ce0ced82ff | F1057B45EAF0B7D08EBC9CC251 3FC0367D23420C4285C3E23D61F310C2 898E19C222E4D0A069C0B0CE0CED82FF 1AA1654F7D8150CEB95FF3247A395658 B60EC08912ADC27717029DC7BB |
| md5 | 9463dd2d5af40b07718c3e10dcb5f975 | 89461D23BA9010CB6D87D094B7 E82279E12A338B4873E6EBE574C12169 9463DD2D5AF40B07718C3E10DCB5F975 CE120870DCB4A6E7B6B71D9C2D15302B 85F4E36EB16FF998881A18B127 |
| md5 | 96009e8a9ce4285305afbb61db1079ac | are the majority of samples that the signature alerted on: 96009E8A9CE4285305AFBB61DB1079AC 4DE9A05A6BCFCD1A3D0FCE79F79C3F3D E7BFA025CBBDB414A15F22562E |
| md5 | 9a22211132c5ca3201a4cf2ee28b5352 | 0C49C5CF46BE3A7D9F11E6C7C3 E782B3FF0987095995AF63A6C8681798 9A22211132C5CA3201A4CF2EE28B5352 70920727A2E104A6367AA557F3CCEEF9 6314E99350AEB8E61EB46025C3 |
| md5 | 9be809cce1b19d28b6d446f2462f32e8 | 98EA625318627CC140EA0A64B0 BE8B003258597F7EEFD8F71D34C8F3C9 9BE809CCE1B19D28B6D446F2462F32E8 6511F0082583111615F49727A4EDF92B F86BBEA440AEE38F212EEFDA81 |
| md5 | 9e00e3c8092a84a8fa56b628ead29197 | 082583111615F49727A4EDF92B F86BBEA440AEE38F212EEFDA817FB4CC 9E00E3C8092A84A8FA56B628EAD29197 C6DA8EC968AD35AF5352D3ED6D50DD1D E7639363693106FC37B19AA428 |
| md5 | a2a2ed4fa691f37e71ed3668209a0223 | 8912ADC27717029DC7BB1DA9F5 B2FE30198633E997AC0434085A634EA4 A2A2ED4FA691F37E71ED3668209A0223 F6A711A44BAA3CE203D6E5D853207821 D8C76AFC1A8BD39E0DA3A8DBE2 |
| md5 | a38555b76113a3a8d7cb871c1e3ec071 | E7E59732416A8295D3E5C58723 0F8DBC492E31B568AC5F713E29BFB996 A38555B76113A3A8D7CB871C1E3EC071 FAFAC7F1057B45EAF0B7D08EBC9CC251 3FC0367D23420C4285C3E23D61 |
| md5 | a77849bea22b7a534963ca85aaf82fc8 | 9F68A19E7FCED9DACE97ADD11A 77EB5B3D855B6A81A55A72432803CB67 A77849BEA22B7A534963CA85AAF82FC8 D658542AEB3A7E304DA20FD820518645 F56AFA89461D23BA9010CB6D87 |
| md5 | abf46deff38160c42dcf76f754d7cd47 | 4E3CE7C68A4971E8E0EB076299 3E8D43DE575690DE1079C6F9D0A585DE ABF46DEFF38160C42DCF76F754D7CD47 36D2E04FA937C97E5E0990B4D8A3DFFE 26B9F2798692698D333169220F |
| md5 | b0709680a86bdd99f968752c9449b809 | 0BAD2091434ACB753105C4FE44 00B74003300FD5800017089F396541B3 B0709680A86BDD99F968752C9449B809 E66E725E10B9CB8A6F5C74D7CA9E98A9 08627677F0B8E6DC45F20E694A |
| md5 | b2fe30198633e997ac0434085a634ea4 | 4F7D8150CEB95FF3247A395658 B60EC08912ADC27717029DC7BB1DA9F5 B2FE30198633E997AC0434085A634EA4 A2A2ED4FA691F37E71ED3668209A0223 F6A711A44BAA3CE203D6E5D853 |
| md5 | b60ec08912adc27717029dc7bb1da9f5 | C222E4D0A069C0B0CE0CED82FF 1AA1654F7D8150CEB95FF3247A395658 B60EC08912ADC27717029DC7BB1DA9F5 B2FE30198633E997AC0434085A634EA4 A2A2ED4FA691F37E71ED366820 |
| md5 | b8ea863d5058214de53e3927a8ea6a2f | 3C1376810FD641E1047CEC4C74 057B060105B32F76DEC9E0104FA44D20 B8EA863D5058214DE53E3927A8EA6A2F D57D8DCA47572B7E75226202C96BCA12 27DB483F92ED1C60648948B301 |
| md5 | bbe8f648b627f828f11b559d14c0840c | 63693106FC37B19AA428BDD9E6 5D5D71DC91BA566D2E5689CB732E415E BBE8F648B627F828F11B559D14C0840C F6686D4589E352BEB2BCAF7EB82A59E8 CF4A3843CC55257D7A6EA2F030 |
| md5 | be8b003258597f7eefd8f71d34c8f3c9 | 77F0B8E6DC45F20E694A56F959 4704AB98EA625318627CC140EA0A64B0 BE8B003258597F7EEFD8F71D34C8F3C9 9BE809CCE1B19D28B6D446F2462F32E8 6511F0082583111615F49727A4 |
| md5 | bf55adbafb776827c77cdc039db4a289 | F17A81F4120728E1E9EC89974A 0DFC013E5220A5E04F227F26FB4CBDCB BF55ADBAFB776827C77CDC039DB4A289 E167C50E69261A944AEED01BE899F5B6 47BF121DC7AF57BA1A93F9F728 |
| md5 | c57e74f17a81f4120728e1e9ec89974a | 244C37CB26E92001C41BF559D8 7537F941ADD2AD9513F4EE93640369C7 C57E74F17A81F4120728E1E9EC89974A 0DFC013E5220A5E04F227F26FB4CBDCB BF55ADBAFB776827C77CDC039D |
| md5 | c62d6b9f68a19e7fced9dace97add11a | 43D56C463DBBD6B6DAD0199748 D82F4BE13B9176477EEECF8D679BA55F C62D6B9F68A19E7FCED9DACE97ADD11A 77EB5B3D855B6A81A55A72432803CB67 A77849BEA22B7A534963CA85AA |
| md5 | c6da8ec968ad35af5352d3ed6d50dd1d | A440AEE38F212EEFDA817FB4CC 9E00E3C8092A84A8FA56B628EAD29197 C6DA8EC968AD35AF5352D3ED6D50DD1D E7639363693106FC37B19AA428BDD9E6 5D5D71DC91BA566D2E5689CB73 |
| md5 | ce120870dcb4a6e7b6b71d9c2d15302b | E12A338B4873E6EBE574C12169 9463DD2D5AF40B07718C3E10DCB5F975 CE120870DCB4A6E7B6B71D9C2D15302B 85F4E36EB16FF998881A18B12779175E 8200F536D57C98CACABB51B56D |
| md5 | cf4a3843cc55257d7a6ea2f0302861ed | 48B627F828F11B559D14C0840C F6686D4589E352BEB2BCAF7EB82A59E8 CF4A3843CC55257D7A6EA2F0302861ED E5DF7143D56C463DBBD6B6DAD0199748 D82F4BE13B9176477EEECF8D67 |
| md5 | d474b4dd44329253157e866bb2e8e460 | 5A6BCFCD1A3D0FCE79F79C3F3D E7BFA025CBBDB414A15F22562E948B56 D474B4DD44329253157E866BB2E8E460 76C348D6C05CFB877CE4C57193A615D7 EAB502723A6CB047F447D2A9FF |
| md5 | d57d8dca47572b7e75226202c96bca12 | 0105B32F76DEC9E0104FA44D20 B8EA863D5058214DE53E3927A8EA6A2F D57D8DCA47572B7E75226202C96BCA12 27DB483F92ED1C60648948B3015F6662 F5EBF33C3F8B1C0BF6BC40935E |
| md5 | d620aadea9e4d177535571e7bab86063 | D6C05CFB877CE4C57193A615D7 EAB502723A6CB047F447D2A9FF1BA994 D620AADEA9E4D177535571E7BAB86063 FE1481B7D9AF4F02A8C4D8070452B7F9 2843847375BB1B97AE7883242A |
| md5 | d658542aeb3a7e304da20fd820518645 | 3D855B6A81A55A72432803CB67 A77849BEA22B7A534963CA85AAF82FC8 D658542AEB3A7E304DA20FD820518645 F56AFA89461D23BA9010CB6D87D094B7 E82279E12A338B4873E6EBE574 |
| md5 | d82f4be13b9176477eeecf8d679ba55f | 43CC55257D7A6EA2F0302861ED E5DF7143D56C463DBBD6B6DAD0199748 D82F4BE13B9176477EEECF8D679BA55F C62D6B9F68A19E7FCED9DACE97ADD11A 77EB5B3D855B6A81A55A724328 |
| md5 | d88018e7e59732416a8295d3e5c58723 | 9350AEB8E61EB46025C3A21F05 3F6DB3A4E5565D2355115E54EEF78757 D88018E7E59732416A8295D3E5C58723 0F8DBC492E31B568AC5F713E29BFB996 A38555B76113A3A8D7CB871C1E |
| md5 | d8c76afc1a8bd39e0da3a8dbe2f1dd90 | 4FA691F37E71ED3668209A0223 F6A711A44BAA3CE203D6E5D853207821 D8C76AFC1A8BD39E0DA3A8DBE2F1DD90 05A7DE0EF9CCBF085C8FECCF46D194AF 788BB0287D7427E617F37E58F7 |
| md5 | e167c50e69261a944aeed01be899f5b6 | 3E5220A5E04F227F26FB4CBDCB BF55ADBAFB776827C77CDC039DB4A289 E167C50E69261A944AEED01BE899F5B6 47BF121DC7AF57BA1A93F9F72848E9BC 5EB4E02485A85FFA2D30837756 |
| md5 | e5df7143d56c463dbbd6b6dad0199748 | 4589E352BEB2BCAF7EB82A59E8 CF4A3843CC55257D7A6EA2F0302861ED E5DF7143D56C463DBBD6B6DAD0199748 D82F4BE13B9176477EEECF8D679BA55F C62D6B9F68A19E7FCED9DACE97 |
| md5 | e66e725e10b9cb8a6f5c74d7ca9e98a9 | 03300FD5800017089F396541B3 B0709680A86BDD99F968752C9449B809 E66E725E10B9CB8A6F5C74D7CA9E98A9 08627677F0B8E6DC45F20E694A56F959 4704AB98EA625318627CC140EA |
| md5 | e7639363693106fc37b19aa428bdd9e6 | C8092A84A8FA56B628EAD29197 C6DA8EC968AD35AF5352D3ED6D50DD1D E7639363693106FC37B19AA428BDD9E6 5D5D71DC91BA566D2E5689CB732E415E BBE8F648B627F828F11B559D14 |
| md5 | e782b3ff0987095995af63a6c8681798 | 3C3F8B1C0BF6BC40935EB150B8 2403010C49C5CF46BE3A7D9F11E6C7C3 E782B3FF0987095995AF63A6C8681798 9A22211132C5CA3201A4CF2EE28B5352 70920727A2E104A6367AA557F3 |
| md5 | e7bfa025cbbdb414a15f22562e948b56 | 8A9CE4285305AFBB61DB1079AC 4DE9A05A6BCFCD1A3D0FCE79F79C3F3D E7BFA025CBBDB414A15F22562E948B56 D474B4DD44329253157E866BB2E8E460 76C348D6C05CFB877CE4C57193 |
| md5 | e82279e12a338b4873e6ebe574c12169 | 2AEB3A7E304DA20FD820518645 F56AFA89461D23BA9010CB6D87D094B7 E82279E12A338B4873E6EBE574C12169 9463DD2D5AF40B07718C3E10DCB5F975 CE120870DCB4A6E7B6B71D9C2D |
| md5 | eab502723a6cb047f447d2a9ff1ba994 | DD44329253157E866BB2E8E460 76C348D6C05CFB877CE4C57193A615D7 EAB502723A6CB047F447D2A9FF1BA994 D620AADEA9E4D177535571E7BAB86063 FE1481B7D9AF4F02A8C4D80704 |
| md5 | f253e8405c2d3a73120525b46f84f6f6 | 26233B3B46BC5B2B5453DCB417 16B9773ACBD0EE27F63B0708F403BE09 F253E8405C2D3A73120525B46F84F6F6 5D89FC0BAD2091434ACB753105C4FE44 00B74003300FD5800017089F39 |
| md5 | f56afa89461d23ba9010cb6d87d094b7 | BEA22B7A534963CA85AAF82FC8 D658542AEB3A7E304DA20FD820518645 F56AFA89461D23BA9010CB6D87D094B7 E82279E12A338B4873E6EBE574C12169 9463DD2D5AF40B07718C3E10DC |
| md5 | f5ebf33c3f8b1c0bf6bc40935eb150b8 | CA47572B7E75226202C96BCA12 27DB483F92ED1C60648948B3015F6662 F5EBF33C3F8B1C0BF6BC40935EB150B8 2403010C49C5CF46BE3A7D9F11E6C7C3 E782B3FF0987095995AF63A6C8 |
| md5 | f6686d4589e352beb2bcaf7eb82a59e8 | DC91BA566D2E5689CB732E415E BBE8F648B627F828F11B559D14C0840C F6686D4589E352BEB2BCAF7EB82A59E8 CF4A3843CC55257D7A6EA2F0302861ED E5DF7143D56C463DBBD6B6DAD0 |
| md5 | f6a711a44baa3ce203d6e5d853207821 | 198633E997AC0434085A634EA4 A2A2ED4FA691F37E71ED3668209A0223 F6A711A44BAA3CE203D6E5D853207821 D8C76AFC1A8BD39E0DA3A8DBE2F1DD90 05A7DE0EF9CCBF085C8FECCF46 |
| md5 | f86bbea440aee38f212eefda817fb4cc | CCE1B19D28B6D446F2462F32E8 6511F0082583111615F49727A4EDF92B F86BBEA440AEE38F212EEFDA817FB4CC 9E00E3C8092A84A8FA56B628EAD29197 C6DA8EC968AD35AF5352D3ED6D |
| md5 | fafac7f1057b45eaf0b7d08ebc9cc251 | 492E31B568AC5F713E29BFB996 A38555B76113A3A8D7CB871C1E3EC071 FAFAC7F1057B45EAF0B7D08EBC9CC251 3FC0367D23420C4285C3E23D61F310C2 898E19C222E4D0A069C0B0CE0C |
| md5 | fe1481b7d9af4f02a8c4d8070452b7f9 | 723A6CB047F447D2A9FF1BA994 D620AADEA9E4D177535571E7BAB86063 FE1481B7D9AF4F02A8C4D8070452B7F9 2843847375BB1B97AE7883242A0E8431 1A67C23252952AD0E35F4E2E77 |
Full article306 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, December 3, 2013 12:11
Bprotector is a fairly popular yet unexceptional family of adware. The thing that distinguishes it from other families is its prevalence. A specific sample, first seen in October 2013, has consistently been on top for detection rates on our FireAMP and Immunet products. The following is the simple strategy that I used for creating the ClamAV signature.
For ClamAV coverage I targeted strings that were shared commonly between the samples that I had on hand. The goal is always to choose content that is generic enough to cover variants but unique enough to not false positive. Targeting the strings is extremely effective in this case because these samples are not obfuscated. This detection, based off of 4 samples, ended up covering more than 90.
The LDB signature can be seen here:
Win.Adware.BProtector;Engine:51-255,Target:1;(0&1&2&3&4);6200500072006F0074006500630074002E00650078006500;6200500072006F0074006500630074002E00730065007400740069006E0067007300;700072006F0074006500630074006F0072002E0064006C006C00;500052004F0054004500430054004F0052005F0044004C004C005F004E0041004D004500;5C004D006F007A0069006C006C0061005C00460069007200650066006F0078005C00500072006F00660069006C00650073002E0069006E006900
Decoded with sigtool --decode-sigs:
VIRUS NAME: Win.Adware.BProtector
TDB: Engine:51-255,Target:1
LOGICAL EXPRESSION: (0&1&2&3&4)
* SUBSIG ID 0
+-> OFFSET: ANY
+-> DECODED SUBSIGNATURE:
bProtect.exe
* SUBSIG ID 1
+-> OFFSET: ANY
+-> DECODED SUBSIGNATURE:
bProtect.settings
* SUBSIG ID 2
+-> OFFSET: ANY
+-> DECODED SUBSIGNATURE:
protector.dll
* SUBSIG ID 3
+-> OFFSET: ANY
+-> DECODED SUBSIGNATURE:
PROTECTOR_DLL_NAME
* SUBSIG ID 4
+-> OFFSET: ANY
+-> DECODED SUBSIGNATURE:
\Mozilla\Firefox\Profiles.ini
For the obligatory MD5 dump, here are the majority of samples that the signature alerted on:
96009E8A9CE4285305AFBB61DB1079AC
4DE9A05A6BCFCD1A3D0FCE79F79C3F3D
E7BFA025CBBDB414A15F22562E948B56
D474B4DD44329253157E866BB2E8E460
76C348D6C05CFB877CE4C57193A615D7
EAB502723A6CB047F447D2A9FF1BA994
D620AADEA9E4D177535571E7BAB86063
FE1481B7D9AF4F02A8C4D8070452B7F9
2843847375BB1B97AE7883242A0E8431
1A67C23252952AD0E35F4E2E77B64369
4FC6464E3CE7C68A4971E8E0EB076299
3E8D43DE575690DE1079C6F9D0A585DE
ABF46DEFF38160C42DCF76F754D7CD47
36D2E04FA937C97E5E0990B4D8A3DFFE
26B9F2798692698D333169220F00C604
5D8820244C37CB26E92001C41BF559D8
7537F941ADD2AD9513F4EE93640369C7
C57E74F17A81F4120728E1E9EC89974A
0DFC013E5220A5E04F227F26FB4CBDCB
BF55ADBAFB776827C77CDC039DB4A289
E167C50E69261A944AEED01BE899F5B6
47BF121DC7AF57BA1A93F9F72848E9BC
5EB4E02485A85FFA2D308377567D0DD8
45ACFF26233B3B46BC5B2B5453DCB417
16B9773ACBD0EE27F63B0708F403BE09
F253E8405C2D3A73120525B46F84F6F6
5D89FC0BAD2091434ACB753105C4FE44
00B74003300FD5800017089F396541B3
B0709680A86BDD99F968752C9449B809
E66E725E10B9CB8A6F5C74D7CA9E98A9
08627677F0B8E6DC45F20E694A56F959
4704AB98EA625318627CC140EA0A64B0
BE8B003258597F7EEFD8F71D34C8F3C9
9BE809CCE1B19D28B6D446F2462F32E8
6511F0082583111615F49727A4EDF92B
F86BBEA440AEE38F212EEFDA817FB4CC
9E00E3C8092A84A8FA56B628EAD29197
C6DA8EC968AD35AF5352D3ED6D50DD1D
E7639363693106FC37B19AA428BDD9E6
5D5D71DC91BA566D2E5689CB732E415E
BBE8F648B627F828F11B559D14C0840C
F6686D4589E352BEB2BCAF7EB82A59E8
CF4A3843CC55257D7A6EA2F0302861ED
E5DF7143D56C463DBBD6B6DAD0199748
D82F4BE13B9176477EEECF8D679BA55F
C62D6B9F68A19E7FCED9DACE97ADD11A
77EB5B3D855B6A81A55A72432803CB67
A77849BEA22B7A534963CA85AAF82FC8
D658542AEB3A7E304DA20FD820518645
F56AFA89461D23BA9010CB6D87D094B7
E82279E12A338B4873E6EBE574C12169
9463DD2D5AF40B07718C3E10DCB5F975
CE120870DCB4A6E7B6B71D9C2D15302B
85F4E36EB16FF998881A18B12779175E
8200F536D57C98CACABB51B56DE7AFB3
7DEECBA357A412F6FA7A3E4F78E723CB
867D609BBA4CE0F489956F0B4EB408A7
0B403BDC26FF08A62CEFB4CA13A90C23
22DC493C1376810FD641E1047CEC4C74
057B060105B32F76DEC9E0104FA44D20
B8EA863D5058214DE53E3927A8EA6A2F
D57D8DCA47572B7E75226202C96BCA12
27DB483F92ED1C60648948B3015F6662
F5EBF33C3F8B1C0BF6BC40935EB150B8
2403010C49C5CF46BE3A7D9F11E6C7C3
E782B3FF0987095995AF63A6C8681798
9A22211132C5CA3201A4CF2EE28B5352
70920727A2E104A6367AA557F3CCEEF9
6314E99350AEB8E61EB46025C3A21F05
3F6DB3A4E5565D2355115E54EEF78757
D88018E7E59732416A8295D3E5C58723
0F8DBC492E31B568AC5F713E29BFB996
A38555B76113A3A8D7CB871C1E3EC071
FAFAC7F1057B45EAF0B7D08EBC9CC251
3FC0367D23420C4285C3E23D61F310C2
898E19C222E4D0A069C0B0CE0CED82FF
1AA1654F7D8150CEB95FF3247A395658
B60EC08912ADC27717029DC7BB1DA9F5
B2FE30198633E997AC0434085A634EA4
A2A2ED4FA691F37E71ED3668209A0223
F6A711A44BAA3CE203D6E5D853207821
D8C76AFC1A8BD39E0DA3A8DBE2F1DD90
05A7DE0EF9CCBF085C8FECCF46D194AF
788BB0287D7427E617F37E58F7A6305D
0039BD936A34B4443F2C476212680238
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/a-quick-tutorial-on-clamav-detection/