Doina.9452 (file analysis)

The Doina.9452 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.9452 virus can do?

Creates RWX memory
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

wpad.local-net

s3.us-east-2.amazonaws.com

How to determine Doina.9452?


File Info:
name: 2074AB7EF64028C55F65.mlw
path: /opt/CAPEv2/storage/binaries/cc6cee5ceec576418e1f6f699ed30ad9a2a73a0a91457ac83faad622b1f8274d
crc32: D95FAAAE
md5: 2074ab7ef64028c55f657e4320064755
sha1: 87aeb6c3e6d6b67aeb36f4f87fae2ed9ba5d6bf3
sha256: cc6cee5ceec576418e1f6f699ed30ad9a2a73a0a91457ac83faad622b1f8274d
sha512: 5d35cb2cf6eca08fd993d03bfa3c3620771ab49a8ccfbfb872b7386b7b300f4cfe474100a91a6fa93899c31931a5da072929edccdd60d85ce8864be2bf7e4638
ssdeep: 12288:CoosZWekyiW5A3/fhqRQ2Xt1Oy9Ks+TYujnvmMs/TUqnj7UP9:bDyyiW5A3/f+Qs7is+Pnvmh/TU+/q9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19B057D23F5A05437D1333BB98C5B57656C36BE106E38784A2BE83D4C5F3A6827D2528B
sha3_384: 5f1f27f6568f93d5d495f43a64e80affab31a5b8d9921cb0bc09d9db9a595edba35adfd0927842cc753c8d5f14097812
ep_bytes: 558bec83c4f053b81c5e4900e81304f7
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Doina.9452 also known as:

Lionic	Trojan.Win32.Banload.a!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.9452
FireEye	Generic.mg.2074ab7ef64028c5
McAfee	Artemis!2074AB7EF640
Cylance	Unsafe
Zillya	Downloader.Banload.Win32.82859
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 00512ad51 )
Alibaba	TrojanDownloader:Win32/Banload.f5c71a7a
K7GW	Trojan-Downloader ( 00512ad51 )
Cybereason	malicious.ef6402
BitDefenderTheta	AI:Packer.EB7CDD9A21
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Banload.YAP
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Downloader.Win32.Banload.aashv
BitDefender	Gen:Variant.Doina.9452
NANO-Antivirus	Trojan.Win32.Banload.esjetr
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-downloader.Banload.Hooi
Ad-Aware	Gen:Variant.Doina.9452
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Emsisoft	Gen:Variant.Doina.9452 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Doina.9452
Jiangmin	TrojanDownloader.Banload.bnbg
eGambit	Unsafe.AI_Score_100%
Avira	TR/Dldr.Delphi.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.21A0C1F
Microsoft	Trojan:Win32/Skeeyah.A!bit
Cynet	Malicious (score: 100)
AhnLab-V3	Downloader/Win32.Banload.C2116028
VBA32	BScope.Trojan.Agent
ALYac	Gen:Variant.Doina.9452
MAX	malware (ai score=100)
Rising	Trojan.Generic@ML.100 (RDML:XiWTHcrKhYEDZmY9bpoYlQ)
Yandex	Trojan.GenAsa!oU/E5xoho3U
Ikarus	Trojan-Downloader.Win32.Banload
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Banload.YAV!tr.dldr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Doina.9452?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Doina.9452 (file analysis)