Backdoor

How to remove “Backdoor:Win32/Phdet”?

Malware Removal

The Backdoor:Win32/Phdet is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:Win32/Phdet virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Backdoor:Win32/Phdet?



File Info:

name: 0259694BA96038F48975.mlw
path: /opt/CAPEv2/storage/binaries/3b5001a7ab0e086058f064abab779388781c95bd84b28c964ca143d38ae9d0ad
crc32: 34522EAE
md5: 0259694ba96038f48975f9775ccbfd5e
sha1: e6b15817cfc67669397310c5b71a490d73f57233
sha256: 3b5001a7ab0e086058f064abab779388781c95bd84b28c964ca143d38ae9d0ad
sha512: 34d40fe3adf9b8bfe099747bd22642995cc804bc200d58d1952da2bb9aeffa5209fd9bbb14f9d70891cb87829c23a64f144c9da670349d73dc6159615438f015
ssdeep: 768:dYY4XPYfi6RofFLXg6bQia3HGuuV0Q3hDof+ZLNFt99J2QBKS0yVVue:QOYLBf8HGD0Q3hzNlfXsS0yVz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14823F271FAC89949E043273824A38BC454753D005FA302AEAD0CBBD6B9B5261F83887F
sha3_384: 3d0853726b6ce0959322744647a2f479e915b40f70aa623216d0194e6dd9787dad4d1d2050ea1af65aa15725157d357c
ep_bytes: 60be004042008dbe00d0fdff5783cdff
timestamp: 2011-06-16 10:36:30


Version Info:

Translation: 0x0409 0x04b0
Comments: xkwn
CompanyName: w
FileDescription: nelbcuqlztgf
LegalCopyright: qdrig vvumbyrl
LegalTrademarks: jnibq dtzopmxbent
ProductName: tbifyyhjc
FileVersion: 20.02.0006
ProductVersion: 20.02.0006
InternalName: shc
OriginalFilename: shc.exe

Backdoor:Win32/Phdet also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.0259694ba96038f4
McAfeeArtemis!0259694BA960
CylanceUnsafe
ZillyaTrojan.VBKrypt.Win32.61435
SangforBackdoor.Win32.Kbot.bri
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:Win32/VBCheMan.a7eecff7
CyrenW32/VBInject.1!Generic
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Agent.NGC
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Vbkrypt-3894
KasperskyBackdoor.Win32.Kbot.bri
BitDefenderGen:Variant.Razy.840289
NANO-AntivirusTrojan.Win32.Agent.ieyew
MicroWorld-eScanGen:Variant.Razy.840289
AvastWin32:Rootkit-gen [Rtk]
TencentWin32.Trojan.Vbkrypt.Crh
Ad-AwareGen:Variant.Razy.840289
SophosML/PE-A + Mal/VBCheMan-C
ComodoSuspicious@#1maeb0q3q76f2
DrWebTrojan.Packed.21773
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_VBKRYPT.BJ
McAfee-GW-EditionBehavesLike.Win32.Generic.pc
EmsisoftGen:Variant.Razy.840289 (B)
IkarusGen.Variant.VBKrypt
GDataGen:Variant.Razy.840289
JiangminBackdoor.Kbot.i
WebrootW32.Pdf.Exploit
AviraTR/Dropper.Gen
Antiy-AVLTrojan/Generic.ASMalwS.1839AE3
KingsoftWin32.Troj.VBKrypt.(kcloud)
MicrosoftBackdoor:Win32/Phdet
BitDefenderThetaAI:Packer.A7503F3320
ALYacGen:Variant.Razy.840289
MAXmalware (ai score=100)
VBA32BScope.Trojan.Zbot.gen
TrendMicro-HouseCallTROJ_VBKRYPT.BJ
RisingBackdoor.Kbot!8.30F4 (CLOUD)
SentinelOneStatic AI – Malicious PE
FortinetW32/VBKrypt!tr
AVGWin32:Rootkit-gen [Rtk]
Cybereasonmalicious.ba9603
PandaGeneric Malware

How to remove Backdoor:Win32/Phdet?

Backdoor:Win32/Phdet removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment