Application.Babar.273895 (file analysis)

The Application.Babar.273895 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.Babar.273895 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Application.Babar.273895?

File Info:
name: CD37755F4C69FE93BE75.mlw
path: /opt/CAPEv2/storage/binaries/a52314d777394751a524d8567cc4a30eb567435655f7cb4b073fdc698bb08d71
crc32: D2A6FB3A
md5: cd37755f4c69fe93be758c451b296f85
sha1: 48a7ff8c7fdb5db4a75ce8afebfb7d85cbcfe5e9
sha256: a52314d777394751a524d8567cc4a30eb567435655f7cb4b073fdc698bb08d71
sha512: 6f6e43c9252f24d889425685759d4877604707783926c7f3adf9c216dad09667110ff7885ed70d7d8d34c15327b1c5ab891786666d1a47b803d8625cace498e8
ssdeep: 6144:fXM3S5PabueGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGYTfpDpweKlxo1cqw:vuuT9CeKDIdiE622
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11D54DFF22A86E706FD274B756255D7E3CA0973965B3A600F73D0FE0BB49B081CA27581
sha3_384: 8301bf59d8ff3742f85805757011bbba2c3c30adc6e383d21b22635ae957dc9af9b24e8c19b47141f0c64fa4375e1827
ep_bytes: 81ecd40200005356576a205f33db6801
timestamp: 2016-12-11 22:16:02

Version Info:
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.40.0
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.40.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.40.0
Translation: 0x0409 0x04b0

Application.Babar.273895 also known as:

How to remove Application.Babar.273895?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.