Malware

Exploit.Win32.Shellcode.vja malicious file

Malware Removal

The Exploit.Win32.Shellcode.vja is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Exploit.Win32.Shellcode.vja virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • A process created a hidden window
  • Creates a hidden or system file
  • Attempts to create or modify system certificates
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
i.imgur.com

How to determine Exploit.Win32.Shellcode.vja?


File Info:

crc32: CA17811C
md5: 4ad3a2b1849cd9963f51199931538927
name: 4AD3A2B1849CD9963F51199931538927.mlw
sha1: 5bed29d52988bbc8052ca42829a450b55b83ea99
sha256: 44eb61ad9603cc802e8a59f356dadedf4be9dc315862a9bb2eddec1bcc9288a8
sha512: 8d12581d8a161f43056063ff8b5eb47a5c84dd7f986dab6c09c37459a04ffc491402a95fb8a73439cc7035763ecc35e1f39051e84c515acf593f957e96810b30
ssdeep: 49152:lAfdVB1Ud6ZBbuSQbScARkDZC3oBxHsz9TT6AvCB7Jcyq/FBGS2bVVGIA2oa:lHdJY683oBZpVqY
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:

FileVersion: 10.0.19041.1
CompanyName: Microsoft Sync Center
ProductName: Microsoft Windows Operating System
ProductVersion: 10.0.19042.8
FileDescription: Microsoft Sync Center
OriginalFilename: mobsync.exe
Translation: 0x0409 0x04e4

Exploit.Win32.Shellcode.vja also known as:

MicroWorld-eScanTrojan.GenericKD.35373369
McAfeeArtemis!4AD3A2B1849C
BitDefenderTrojan.GenericKD.35373369
SymantecTrojan.Gen.2
ESET-NOD32a variant of Win32/GenCBL.KT
APEXMalicious
KasperskyExploit.Win32.Shellcode.vja
AlibabaTrojan:Win32/GenCBL.12157335
Ad-AwareTrojan.GenericKD.35373369
DrWebBackDoor.Rat.281
TrendMicroTROJ_FRS.VSNW19K20
McAfee-GW-EditionArtemis!Trojan
FireEyeTrojan.GenericKD.35373369
EmsisoftMalCert-S.DI (A)
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:Win32/Wacatac.B!ml
ArcabitTrojan.Generic.D21BC139
ZoneAlarmExploit.Win32.Shellcode.vja
GDataWin32.Trojan.Kryptik.AOXSHS
ALYacBackdoor.Remcos.A
MAXmalware (ai score=87)
TrendMicro-HouseCallTROJ_FRS.VSNW19K20
IkarusTrojan.Win32.Gencbl
FortinetW32/Rugmi.FAH!tr.dldr
AVGWin32:DangerousSig [Trj]
AvastWin32:DangerousSig [Trj]
Qihoo-360Win32/Trojan.9ad

How to remove Exploit.Win32.Shellcode.vja?

Exploit.Win32.Shellcode.vja removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment