Bulz.14493 (file analysis)

The Bulz.14493 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.14493 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Deletes its original binary from disk
• CAPE detected the PCRat malware family
• Creates a copy of itself

How to determine Bulz.14493?

File Info:
name: 50A84B2C93679F34A4B7.mlw
path: /opt/CAPEv2/storage/binaries/297d120d8fe3bb8c5a9bc55fc1269a78fa90d235f8a6b2feadb69a59f50a396a
crc32: 1DD11EE3
md5: 50a84b2c93679f34a4b74fc92ec32bf6
sha1: 53d77a4d03de8a80867f421bbd7a0c85670ec250
sha256: 297d120d8fe3bb8c5a9bc55fc1269a78fa90d235f8a6b2feadb69a59f50a396a
sha512: b422e2b88b7a07f54af35a42b29d65971bce014f88271a7119cdb7d69d048177156c31eef778f8dc0d8c364cbdb2e6bd5f8a34e13bf4a37ee7ba401ed8cad58d
ssdeep: 49152:lD2tYZeYZeYZeYZeYZeYZeYZoYZeYZeYZeYZMYZU0+YZeYZeYZ6dVYI8O3q:lDdSdr8O3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BE16098AEE24D1BEC4131BB8EA5B69F412501C16992E215F38143E7FEE33B671905FB4
sha3_384: 9e8a4fe387a80b1ba6d108436eb536a4c826ecab8b94a6ecdade7f9ede0761e5d0d9ca8364023901863ee8f5cb32e15b
ep_bytes: 558bec6aff6898db400068b4a9400064
timestamp: 2018-04-04 10:11:56

Version Info:
Comments: 
CompanyName: Free Time Co., Ltd.
FileDescription: FormatFactory
FileVersion: 3.9.5.0
InternalName: FormatFactory
LegalCopyright: Copyright 2016 Free Time Co., Ltd.
LegalTrademarks: 
OriginalFilename: FormatFactory.exe
PrivateBuild: 
ProductName: Format Factory
ProductVersion: 3.9.5.0
SpecialBuild: 
Translation: 0x0804 0x04b0

Bulz.14493 also known as:

How to remove Bulz.14493?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.