Malware

Doina.13418 removal

Malware Removal

The Doina.13418 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Doina.13418 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Unconventionial binary language: Portuguese (Brazil)
  • Unconventionial language used in binary resources: Portuguese (Brazilian)
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

How to determine Doina.13418?



File Info:

name: 3953703F9FC3CB0D68E6.mlw
path: /opt/CAPEv2/storage/binaries/9c1c5e650415ab17d50a993c9f5e1530a73c8426214bc316c87c696b22dfe487
crc32: 51284FA7
md5: 3953703f9fc3cb0d68e6ff37338b7383
sha1: 08bd3a89fcb191973443f03496c984559484751c
sha256: 9c1c5e650415ab17d50a993c9f5e1530a73c8426214bc316c87c696b22dfe487
sha512: b71ae52c9c61db5e6515d52068814cccf0800037d0fa5f811d04a5499f3ad1f141a8ab3aac9f2437d57205dbdd0d158019321e3c5a1c9c4a7f96f8299d4a2b95
ssdeep: 12288:UaQZvfhnd5JJLDQZTMl8/EMjoTrBE3A3Gz1BT9pIK:U3tL56MGEOoTSA3s
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T159C46C32B981C433E1721EBCDC2797B45C29BE01B624944B3FE53E4D5F39B41AA26297
sha3_384: 0d305fb5ea0173025bf474d1c64cfde077136cc8716e0dbb0255c4612920aefb4e3a5691690a002075437ad89ede97ec
ep_bytes: 558bec83c4f05356b864ecf807e85a74
timestamp: 1992-06-19 22:22:17


Version Info:

CompanyName: Atualização de Proteção ao Cliente.
FileDescription: Atualização de Segurança.
FileVersion: 1.0.0.1
InternalName: atualizador.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: Atualizador
ProductName: 
ProductVersion: 1.0.0.1
Comments: 
Translation: 0x0416 0x04e4

Doina.13418 also known as:

LionicTrojan.Win32.Banbra.lNPd
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Doina.13418
FireEyeGeneric.mg.3953703f9fc3cb0d
ALYacGen:Variant.Doina.13418
CylanceUnsafe
VIPRETrojan.Win32.Generic.pak!cobra
SangforTrojan.Win32.Agent.gen
K7AntiVirusSpyware ( 004b0ae81 )
AlibabaTrojanBanker:Win32/Generic.5e838acc
K7GWSpyware ( 004b0ae81 )
Cybereasonmalicious.9fcb19
BitDefenderThetaAI:Packer.CC52B9B721
SymantecML.Attribute.HighConfidence
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Banker.Win32.Agent.gen
BitDefenderGen:Variant.Doina.13418
NANO-AntivirusTrojan.Win32.Banker.ffmpsp
AvastWin32:Malware-gen
TencentWin32.Trojan.Falsesign.Lkdv
Ad-AwareGen:Variant.Doina.13418
SophosMal/Generic-S
ComodoMalware@#3i7zwc7cjjyzb
DrWebTrojan.MulDrop8.30567
ZillyaTrojan.Agent.Win32.966393
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Doina.13418 (B)
APEXMalicious
GDataGen:Variant.Doina.13418
MAXmalware (ai score=97)
MicrosoftTrojan:Win32/Occamy.C9C
CynetMalicious (score: 100)
McAfeeArtemis!3953703F9FC3
VBA32TScope.Trojan.Delf
MalwarebytesMachineLearning/Anomalous.100%
YandexTrojan.GenAsa!yI988Qopbz8
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Generic!tr
AVGWin32:Malware-gen
PandaTrj/GdSda.A

How to remove Doina.13418?

Doina.13418 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment