Application.Nirsoft.2 (file analysis)

The Application.Nirsoft.2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Application.Nirsoft.2 virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Network activity detected but not expressed in API logs

How to determine Application.Nirsoft.2?


File Info:
crc32: B3ED2308
md5: c9da5afa1f7d488a823454931691c1d1
name: C9DA5AFA1F7D488A823454931691C1D1.mlw
sha1: d1eef881e8e81d61c7d8fa20bb69a12a50271fb8
sha256: 650145948396f646a89133530fb6d4f6547eec81346314192a7b5ddde111916d
sha512: 4728b1f70a4951f3751e9199115f61b248a634af053abc8a8b72b9fd553e55e995b8dba88e1117bf1b583136a3bb529baf3316f2fb702e688358e7ed1f367cbf
ssdeep: 6144:INys4WAFvan3GXlzcHgIl3LiQuFEsUvccdnl1u:lvs3RHviQuvkO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: SAGA Incorporated, Copyright (C) 1998
InternalName: DSplit
FileVersion: 1, 0, 0, 1
CompanyName: 
ProductName: Dynamic splitter (demo)
ProductVersion: 1, 0, 0, 1
FileDescription: Dynamic splitter (demo)
OriginalFilename: DSplit.EXE
Translation: 0x0409 0x04b0

Application.Nirsoft.2 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 004d7e5a1 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Application.Nirsoft.2
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 004d7e5a1 )
Cybereason	malicious.a1f7d4
Cyren	W32/Trojan.CYOE-2242
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
BitDefender	Gen:Variant.Application.Nirsoft.2
MicroWorld-eScan	Gen:Variant.Application.Nirsoft.2
Ad-Aware	Gen:Variant.Application.Nirsoft.2
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	AI:Packer.15BB66741F
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.c9da5afa1f7d488a
Emsisoft	Gen:Variant.Application.Nirsoft.2 (B)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_60%
Microsoft	Trojan:Win32/Caynamer.A!ml
Arcabit	Trojan.Application.Nirsoft.2
AegisLab	Trojan.Win32.Nirsoft.4!c
GData	Gen:Variant.Application.Nirsoft.2
McAfee	Artemis!C9DA5AFA1F7D
MAX	malware (ai score=72)
Rising	Malware.Heuristic!ET#99% (RDMK:cmRtazo4ULHgjMIIJiyOTDHsRhTg)
Fortinet	W32/Filecoder.FV!tr.ransom
AVG	FileRepMalware
Paloalto	generic.ml

How to remove Application.Nirsoft.2?

Application.Nirsoft.2 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X