Dial/WebDial-A (file analysis)

The Dial/WebDial-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Dial/WebDial-A virus can do?

The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to repeatedly call a single API many times in order to delay analysis time
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Dial/WebDial-A?


File Info:
crc32: 46D8D30F
md5: 7e94f69efea6376e5114edf591706ce3
name: 5-2-46-286.exe
sha1: 67f525c1d842d4ea508ed0c714d4bbe1c0e64974
sha256: 2fa1982e8cda7659ce1e2704b8132c337a414817ac6f7d4f341274ba8a3f9a95
sha512: a8c29daafe290baf2ba28931ee0d9c3a4e61e0ebf925f9db78b88e88fa2a006936e75ff1741cbe0176d18d1a44f307a4362e397cb9337594728dda2e1c1dcfc0
ssdeep: 1536:Bx/0fXKXAkU49OV+SGEYBocUaAuCSXebCM4TzeDP3b85E3:Bx/0f7dwBoKUSubGTCzr8S
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright xa9 2001-2002 keen+partner gmbh
InternalName: webdialer
FileVersion: 3, 0, 0, 53
CompanyName: keen+partner gmbh
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: webdialer
SpecialBuild: 
ProductVersion: 4, 0, 0, 2
FileDescription: 
OriginalFilename: 
Translation: 0x0407 0x04b0

Dial/WebDial-A also known as:

MicroWorld-eScan	Application.Dialer.Q
FireEye	Application.Dialer.Q
CAT-QuickHeal	Trojan.GenericRI.S7513510
Qihoo-360	HEUR/QVM11.1.514B.Malware.Gen
McAfee	Dialer-Generic.b
VIPRE	BehavesLike.Win32.Malware.wsc (mx-v)
AegisLab	Riskware.Win32.Small.l2hr
Sangfor	Malware
K7AntiVirus	Dialer ( 0055e3fa1 )
BitDefender	Application.Dialer.Q
K7GW	Dialer ( 0055e3fa1 )
Cybereason	malicious.efea63
TrendMicro	DIAL_RAS.HT
BitDefenderTheta	Gen:NN.ZexaF.34090.dmKfaSGiKJr
Cyren	W32/Dialer.S.gen!Eldorado
Symantec	Dialer.Generic
TotalDefense	Win32/Dialer.Webdialer
TrendMicro-HouseCall	DIAL_RAS.HT
ClamAV	Win.Trojan.Dialer-83
GData	Application.Dialer.Q
Kaspersky	Trojan.Win32.Scar.ogkx
NANO-Antivirus	Riskware.Win32.WebDialer.bnzio
Tencent	Malware.Win32.Gencirc.10b70573
Ad-Aware	Application.Dialer.Q
Sophos	Dial/WebDial-A
Comodo	ApplicUnwnt.Win32.PornDialer.Webdialer.DA@4n4flj
F-Secure	Dialer.DIAL/000153
DrWeb	Dialer.Webdial
Zillya	Dialer.WebDialer.Win32.96
Invincea	heuristic
McAfee-GW-Edition	Dialer-Generic.b
SentinelOne	DFI – Suspicious PE
CMC	Porn-Dialer.Win32.Small!O
Emsisoft	Application.Dialer.Q (B)
APEX	Malicious
F-Prot	W32/Dialer.S.gen!Eldorado
Jiangmin	Porn-Dialer.WebDialer.k
Webroot	W32.Dialer.Gen
Avira	DIAL/000153
Antiy-AVL	GrayWare[Porn-Dialer]/Win32.WebDialer
Endgame	malicious (moderate confidence)
Arcabit	Application.Dialer.Q
SUPERAntiSpyware	Trojan.Agent/Gen-Dialer
ZoneAlarm	Trojan.Win32.Scar.ogkx
Microsoft	Dialer:Win32/PornDialer
AhnLab-V3	Unwanted/Win32.Dialer.R101528
VBA32	PornDialer.WebDialer
ALYac	Application.Dialer.Q
MAX	malware (ai score=74)
Panda	Dialer.Gen
ESET-NOD32	a variant of Win32/Dialer.WebDial
Rising	Worm.Tedeos!8.5B48 (RDMK:cmRtazqvv1FPJBfxHmXX+HjGc2AX)
Yandex	Dialer.Webdialer.Gen
Ikarus	Dialer
Fortinet	W32/Dialer.DIAL!tr
AVG	Win32:Dh-A [Heur]
Avast	Win32:Dh-A [Heur]
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Dial/WebDial-A?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Dial/WebDial-A (file analysis)