Bulz.655723 (file analysis)

The Bulz.655723 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.655723 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (14 unique times)
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config

How to determine Bulz.655723?

File Info:
name: 4CB533BF1F579BA14622.mlw
path: /opt/CAPEv2/storage/binaries/a9ee3ede508de714e92f52473a86c5c60c07056f9f32e8aefa26f3900a7dd285
crc32: 1ADF755E
md5: 4cb533bf1f579ba146227817d4bcc1f6
sha1: a58b90614b638ca5c805aa26e91619f70d5b64c2
sha256: a9ee3ede508de714e92f52473a86c5c60c07056f9f32e8aefa26f3900a7dd285
sha512: f48072a854cd280afd0645345ba190f8522e2614b00d04c7f49a890dc5faead992953935105cd2a902f7cc91b536111989d652fbc2c76d37f26f0a5cc430c6f4
ssdeep: 49152:B/OvIilgs0xUq5o7lDrfvhgBFfJBUNLKvXgV:BWvIiYeso7lDrHhwFfsLK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T190E5AE9125D0846AE3F101742DD9112F89BD7C2F1A2A8E537AC9F1FD28367FC5A30A67
sha3_384: 23d5e3812b57679aee255352674bc2872d15e2beb389ba07c8bd937566425c0273f79ebf70700f26f670724b2fc89397
ep_bytes: e891750000e97ffeffff3b0d60784a00
timestamp: 2021-08-25 06:27:22

Version Info:
CompanyName: TODO:  
FileVersion: 1.0.0.1
LegalCopyright: TODO:  (C) 。  保留所有权利。
ProductName: TODO:  
ProductVersion: 1.0.0.1
Translation: 0x0804 0x04b0

Bulz.655723 also known as:

How to remove Bulz.655723?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.