About “Doina.29303 (B)” infection

The Doina.29303 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.29303 (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Doina.29303 (B)?

File Info:
name: 3CD86533391D499721AC.mlw
path: /opt/CAPEv2/storage/binaries/eee95086c29146467c5eb1e374abc619e4aa1778eae8baf4ca001468feb40ae8
crc32: 69EBF67B
md5: 3cd86533391d499721ace01d6d1da048
sha1: 3751a72cb4768205cfa12d948c0020a45cbfd9a3
sha256: eee95086c29146467c5eb1e374abc619e4aa1778eae8baf4ca001468feb40ae8
sha512: df7f18f3ef9472e95d802f4e701a7cc77bd6affa36a976424133096f72d38050fe9a63addfd9eb3a18a40ba62b90ba42580bd9ac696b7fcda94eed59fa2cec95
ssdeep: 6144:yuriaXiIhVpHPMvGMIdt+mWgM5irinUVu0phCRlo1I+pcs2UTP:yu2ayIRHUyt+Zrii0h3CLSQUTP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D474239F43ED95F9CD2295F21E9B9B8EF7F088051BC7AD5CB90661C46C442287C24B8B
sha3_384: 9a322fca63ab0746ccb93271de4c564d1d6f3bf4698c48bfa467e45d6016d0aae23a78f37d69b5d1d98dafd4eefbb927
ep_bytes: 9ce9b2f2ffffa096a249c879d25494e6
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Doina.29303 (B) also known as:

How to remove Doina.29303 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.