Backdoor:Win32/Phdet.A (file analysis)

The Backdoor:Win32/Phdet.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Phdet.A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Created a process from a suspicious location
• Deletes executed files from disk

How to determine Backdoor:Win32/Phdet.A?

File Info:
name: B3F4C86121966F43669C.mlw
path: /opt/CAPEv2/storage/binaries/01425582aa5001342b985270a365fd92d909be011384247e81872bff586fa142
crc32: 9A41604E
md5: b3f4c86121966f43669c4e06d47c8a08
sha1: 285b3252a878d1c633ea988153bbc23c148dd630
sha256: 01425582aa5001342b985270a365fd92d909be011384247e81872bff586fa142
sha512: 8f0e575cedd63e8d25eb49c7e1343d13df487e64001673e5a0da76624c058fc884a7795fbfe1257b2576d5dc497e6cbbb7beed38aa27488e2303b192e8da595a
ssdeep: 1536:pQi64ewOlS4QaRg1fNOIBfKvhl3WqHocLTXG19wgYivm/XJv:pV64Ow2g1VfBfohl3fZTXAb6XJv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B6E32902FFD47D61C0E64A38A496C330DB27DC92C6A9435334DA7E1BBE35165AE43B92
sha3_384: 946ad2e2102c86ef8be55df4a397b57a04af16d63b09f3c030ce92caa7d8399e5cb2d93909d7bb449bac4c247a5939c0
ep_bytes: 558bec83ec285657b8410400008bc883
timestamp: 2014-05-12 10:15:17

Version Info:
0: [No Data]

Backdoor:Win32/Phdet.A also known as:

How to remove Backdoor:Win32/Phdet.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.