Application.Agent.DFH removal instruction

The Application.Agent.DFH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.Agent.DFH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Detects the presence of Wine emulator via registry key
• Accessed credential storage registry keys
• Anomalous binary characteristics

How to determine Application.Agent.DFH?

File Info:
name: 4D7D5D03D9B4D9988313.mlw
path: /opt/CAPEv2/storage/binaries/c87e1210b9d052c91f3e71c9f83c1873d0221467c1fc927014f26640e55c5639
crc32: F9C4AFF0
md5: 4d7d5d03d9b4d9988313e5e85b3ec0a5
sha1: d58c1736209d907353eefd218f259d647bf8b316
sha256: c87e1210b9d052c91f3e71c9f83c1873d0221467c1fc927014f26640e55c5639
sha512: 282d1444862ff8596bc0f052939e49da9804801335e222bcb6e1c36ff4fde8bf28c0a520e4918b00aaac0ad4c15503913f892cff8992a2091fdcd2f556c1b325
ssdeep: 24576:wKXgvn3QMDRkXRz5dRKiR+2brLVvs5G5cGMiHZUxZGoEmzogo/pRX4y:uvn3QDBR/rLVU85cGPZUxZGoEdb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C395D0066A50E929D0B62D741D2EF32C8A346E60CE76CED763453D6FBF329F1182531A
sha3_384: fedd5a545f46d5f0f8afb26292f67b550fb0e07e07d2dea58985ecf254af31aaaba2f794516f33be74e2af7b86a8373b
ep_bytes: 558bec6aff68f081500068783b500064
timestamp: 2018-07-24 00:07:54

Version Info:
CompanyName: Borland Software Corporation
FileDescription: Delphi Pascal Compiler
FileVersion: 7.0.4.453
LegalCopyright: Copyright (c) 1983,2001 Borland Software Corporation
Copyright: Copyright (c) 1983,2001 Borland Software Corporation
ProductName: Borland Delphi/C++Builder (Enterprise Edition)
ProductVersion: 7.0.4.453
InternalName: DCC32
Translation: 0x0409 0x04e4

Application.Agent.DFH also known as:

How to remove Application.Agent.DFH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.