Application.Babar.273895 (file analysis)

The Application.Babar.273895 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.Babar.273895 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Touches a file containing cookies, possibly for information gathering
• Yara detections observed in process dumps, payloads or dropped files

How to determine Application.Babar.273895?

File Info:
name: BFE2E967CA15C1D4A286.mlw
path: /opt/CAPEv2/storage/binaries/3107e027ecaf999972ebd8be76eaa793f24e31db4510f7d771fbf5001758d9e5
crc32: B9ED8CB0
md5: bfe2e967ca15c1d4a2863aa831b3dd18
sha1: 142af4b902642a9030d867ae0c05e3504e1d71b3
sha256: 3107e027ecaf999972ebd8be76eaa793f24e31db4510f7d771fbf5001758d9e5
sha512: 5d56f0181b1884acff62ecbf754c128a84cdf59cdd6ffa9bdcea44a56ea89977631ff607db1f89a1f37a63f466371fbc4cb67f6eca9899f185d36ad63bb5f3e5
ssdeep: 6144:HXMvzS5PabueGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGYMNm/0Jxxj9kbNH:30TuMk/ixT6Bi5SIEQLo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11854E1403F92EA2BD9A323335D253957EE64B966317183DB0F802F9B351B18A8BFD511
sha3_384: f1151d2ecb1268a6a7c337e71032a79a87a112c95f6805b7f19be1b88cfa6321644350d338fb7f686af855fdc655c3dc
ep_bytes: 81ecd40200005356576a205f33db6801
timestamp: 2016-12-11 11:26:40

Version Info:
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.40.0
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.40.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.40.0
Translation: 0x0409 0x04b0

Application.Babar.273895 also known as:

How to remove Application.Babar.273895?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.