Categories: Adware

Adware.SMSHoax.E malicious file

The Adware.SMSHoax.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware.SMSHoax.E virus can do?

Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
CAPE detected the embedded win api malware family
Touches a file containing cookies, possibly for information gathering
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Adware.SMSHoax.E?


File Info:
name: A729C279A14F5BE6C85B.mlwpath: /opt/CAPEv2/storage/binaries/24c1295e7bb45b94f6082c5abb7ae4d694c92ed703d6dcd9243ba9b2188afc14crc32: 2193446Cmd5: a729c279a14f5be6c85bbb806d00d880sha1: 6d184ecc1bfca28903d684610723f5796ab5e1desha256: 24c1295e7bb45b94f6082c5abb7ae4d694c92ed703d6dcd9243ba9b2188afc14sha512: 0779c774f9834577054c42129d2ba7a53b45e4ccdf446d8059a8101e78c424009bbea02317989b68b2ecceda9f0e35e2272918ed7a02d387662617f9d090753dssdeep: 98304:9qChw8eE5jTaWOx/7fXyQtuU7Pt0qG/qJZDv5gO8Thq:0C28eE5/k/7fBtZ7VfJZDlTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B046B0F2B384603AD2B71A3A8437A674583FBF212A16CC4B57B41E4C8F352516D3A75Bsha3_384: 3a94069c4d35e3b3cf9218e9f19cd0e179ba59b9f8490a0e26937226d55edcea1707f3346fb2ed0c4c781fbb60cf62c0ep_bytes: 558bec83c4f0b810c86d00e8d426d1fftimestamp: 2013-12-03 07:48:21
Version Info:
FileVersion: 1.0.0.0ProductVersion: 1.0.0.0Translation: 0x0409 0x04e4

Adware.SMSHoax.E also known as:

Lionic	Hacktool.Win32.ArchSMS.mpCx
Elastic	malicious (high confidence)
MicroWorld-eScan	Adware.SMSHoax.E
FireEye	Generic.mg.a729c279a14f5be6
CAT-QuickHeal	Adware.SmsHoax.Gen
Skyhigh	BehavesLike.Win32.Generic.tc
McAfee	Artemis!A729C279A14F
Cylance	unsafe
Zillya	Trojan.ArchSMS.Win32.20647
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055e3991 )
Alibaba	RiskWare:Win32/ArchSMS.f505d7f1
K7GW	Trojan ( 0055e3991 )
Cybereason	malicious.c1bfca
BitDefenderTheta	Gen:NN.ZelphiCO.36680.@R3@ae3lRWdk
VirIT	Trojan.Win32.FakeAV.ASOB
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ATIS
Avast	Win32:AdwareSig [Adw]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Adware.SMSHoax.E
NANO-Antivirus	Trojan.Win32.InstallMonster.dbisaf
Emsisoft	Adware.SMSHoax.E (B)
F-Secure	Trojan.TR/Fraud.Gen2
DrWeb	Trojan.SMSSend.4556
VIPRE	Adware.SMSHoax.E
Sophos	Troj/ArchSMS-X
GData	Adware.SMSHoax.E
Jiangmin	Hoax.ArchSMS.ahjo
Avira	TR/Fraud.Gen2
Antiy-AVL	Trojan/Win32.Inject
Kingsoft	Win32.Trojan.Generic.a
Xcitium	TrojWare.Win32.Injector.ATIS@55m5a5
Arcabit	Adware.SMSHoax.E
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Ditertag.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.ArchSMS.R92461
VBA32	Trojan.SMSSend
ALYac	Adware.SMSHoax.E
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Yandex	Adware.Agent!l216LqAO7ek
Ikarus	Trojan.Fakeav
Fortinet	W32/Injector.AYAG!tr
AVG	Win32:AdwareSig [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)