Malware

Should I remove “Doina.30559”?

Malware Removal

The Doina.30559 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Doina.30559 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Doina.30559?



File Info:

name: 008A75B6892FBA3517AA.mlw
path: /opt/CAPEv2/storage/binaries/82ab51ddd3d3174e61dcf5f1651745a1889674ae135bb9ad25e852cf7851718d
crc32: 47FA8D9D
md5: 008a75b6892fba3517aa574376d4bbff
sha1: 4097a033c3a21f5c7018098c1ba19d717fff1f82
sha256: 82ab51ddd3d3174e61dcf5f1651745a1889674ae135bb9ad25e852cf7851718d
sha512: 83a841ea8bd69cfb0202a4b04dbe49be933b8f1c7e254a8821108393d8b71e7cbaad50217a7a50dceae70f22aa2ba5342398a6c26fefa3b2129dfe3fcc0417c3
ssdeep: 196608:llAAJawMgKEFb3twM8+/iMcH5AVKLSnDyQmDG7xnV0i2/knpCq8f3eHYXSiLT/eY:lJawMg5w0iMO5AVKLEeDqx6i28npCF3c
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T152B6336664A553F5EEA29C30491B78E4458C3C6B7CC830B04FA5E5B85D36DD38ACAF0B
sha3_384: 8a33efca3b0435b4795b7b0ce08c4e948378ba50031cb53952337bf1608ebb74dafba654d48e6226a9fa87bd635c478c
ep_bytes: 60be00a06e008dbe0070d1ff57eb0b90
timestamp: 2022-01-03 11:23:27


Version Info:

Comments: 
CompanyName: Install Assist
FileDescription: Ms-Zip Install Assistant
FileVersion: 8.5.1.6
InternalName: MsZipInstall.exe
LegalCopyright: Copyright (c) 2021 Ms-Zip
OriginalFilename: MsZipInstall.exe.exe
ProductName: MsZipInstall.exe
ProductVersion: 8.5.1.6
Translation: 0x0804 0x04b0

Doina.30559 also known as:

LionicAdware.Win32.Agent.2!c
Elasticmalicious (moderate confidence)
MicroWorld-eScanGen:Variant.Doina.30559
FireEyeGeneric.mg.008a75b6892fba35
McAfeeGenericRXAA-AA!008A75B6892F
CylanceUnsafe
SangforTrojan.Win32.Agent.ky
AlibabaAdWare:Win32/YouXun.102d
K7GWRiskware ( 00582a371 )
K7AntiVirusRiskware ( 00582a371 )
BitDefenderThetaGen:NN.ZexaF.34638.@pKfaSCGyLhj
CyrenW32/Trojan.KEKL-7779
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/RiskWare.YouXun.AE
TrendMicro-HouseCallTROJ_GEN.R067C0WAE22
Paloaltogeneric.ml
CynetMalicious (score: 100)
Kasperskynot-a-virus:UDS:AdWare.Win32.Agent
BitDefenderGen:Variant.Doina.30559
AvastWin32:AdwareX-gen [Adw]
TencentWin32.Trojan.Malware.Kfln
Ad-AwareGen:Variant.Doina.30559
SophosGeneric PUA EA (PUA)
DrWebTrojan.Siggen16.25965
ZillyaTool.YouXun.Win32.1546
TrendMicroTROJ_GEN.R067C0WAE22
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
EmsisoftGen:Variant.Doina.30559 (B)
APEXMalicious
GDataGen:Variant.Doina.30559
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
Acronissuspicious
ALYacGen:Variant.Doina.30559
MAXmalware (ai score=87)
VBA32BScope.Trojan.FakeAlert
MalwarebytesRiskWare.Agent
RisingAdware.LinkAdd!1.CD70 (CLOUD)
YandexPUA.Downloader!kWzSazKby70
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.138628648.susgen
FortinetRiskware/YouXun
AVGWin32:AdwareX-gen [Adw]
Cybereasonmalicious.3c3a21

How to remove Doina.30559?

Doina.30559 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment