Generic.Exploit.Shellcode.3.0EF152B8 malicious file

The Generic.Exploit.Shellcode.3.0EF152B8 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Exploit.Shellcode.3.0EF152B8 virus can do?

• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Generic.Exploit.Shellcode.3.0EF152B8?

File Info:
name: CC99DC74A7CB6D6857B3.mlw
path: /opt/CAPEv2/storage/binaries/d6b56b75fbbfc1185861d3521e9564230301c8095c489ce9d70206be9d42df3d
crc32: 7D7C52F3
md5: cc99dc74a7cb6d6857b3b5020f803dfa
sha1: 864f15b120e9919a718d11a8a712e0e857be11ed
sha256: d6b56b75fbbfc1185861d3521e9564230301c8095c489ce9d70206be9d42df3d
sha512: d86911115726fcde304cc7f5fde0c319e332a9d2ddbf35b98caf5b6beeff3582e29d257e0806543e08a91aee6ed21158b0a1c8725a9bd75a0f3ad7bfdda9ad26
ssdeep: 768:IWT1xbvTkPT0XRVh2MmdlgNevdBuoHclRT9rrA9BbuvoTQCZejZPmwwp3mscZsbT:IE15cT0XRDYdlqeHreRT9vA3bYoTJZeU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18623F194BEF005A1F0B737B512B613365B22B8C39E36BB6C4112662D4496710BF64F7A
sha3_384: 5e1e47d91ff762afaaaa8e7f3a3d85f39b69f32637c9e5bffe1b69f61c9ca4f481c6638c1a15e8ae63fef3ebcb3afbc8
ep_bytes: 60be00d040008dbe0040ffff5783cdff
timestamp: 2009-05-23 22:05:23

Version Info:
Comments: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName: Apache Software Foundation
FileDescription: ApacheBench command line utility
FileVersion: 2.2.14
InternalName: ab.exe
LegalCopyright: Copyright 2009 The Apache Software Foundation.
OriginalFilename: ab.exe
ProductName: Apache HTTP Server
ProductVersion: 2.2.14
Translation: 0x0409 0x04b0

Generic.Exploit.Shellcode.3.0EF152B8 also known as:

How to remove Generic.Exploit.Shellcode.3.0EF152B8?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.