AdWare.Win32.DealPly.dpxer (file analysis)

The AdWare.Win32.DealPly.dpxer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.DealPly.dpxer virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine AdWare.Win32.DealPly.dpxer?

File Info:
name: 2A448FA3BBFC69D7275C.mlw
path: /opt/CAPEv2/storage/binaries/21a67bf58a054682a0f06f6d79ff29f1e6fcefbc6b8972adb6b0440dd6f09c1c
crc32: 94202C12
md5: 2a448fa3bbfc69d7275cae49405212d2
sha1: 8e804cc601b533ddc43a535d8f4a62be86b86913
sha256: 21a67bf58a054682a0f06f6d79ff29f1e6fcefbc6b8972adb6b0440dd6f09c1c
sha512: 6935d76fcfad707d8de7f699c31ee4fb5e5e9c5476bf1ed3ad59543c1592f722ed549d3ea9eea84421e361bc8df5ebe871c40299e21f9bba8ec39afef826c1c4
ssdeep: 12288:Z5fa8vwTb/NxDMQlw9RJ+0d8ZhpOH2/3119anH3X6r1NW9+qk:ZVUTb//vlwfYrlb/32X65NW9O
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19AD4232FC3EECB52D738E87151496CB3060D3C5E698A6131628D63BBCCF6511A865FCA
sha3_384: 998c91c9d9f01a3de20588b8d44d8c565a6f8433a44017b2dd6f85152b473db806d620f1fa70b4880ef955448b763569
ep_bytes: 60be005058008dbe00c0e7ffc787102c
timestamp: 2013-03-12 07:34:37

Version Info:
0: [No Data]

AdWare.Win32.DealPly.dpxer also known as:

How to remove AdWare.Win32.DealPly.dpxer?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.