Categories: Ransom

Generic.Ransom.Hiddentear.A.FD1D642F (B) (file analysis)

The Generic.Ransom.Hiddentear.A.FD1D642F (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.Ransom.Hiddentear.A.FD1D642F (B) virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Network activity detected but not expressed in API logs

How to determine Generic.Ransom.Hiddentear.A.FD1D642F (B)?


File Info:
crc32: B8840875md5: 212d6c99eeeba1c6e6304d372ee2d3d5name: 212D6C99EEEBA1C6E6304D372EE2D3D5.mlwsha1: a603db6520386777545b3b00594fb706aaf0735fsha256: 8e25b9207aaa4ce36b786eb3db15ae4245d70b7a072b1c900cb1482971c28b1dsha512: c9b9942ccfd7a04e2a5f9af2299dda73cf6e422e5db0631e7f8dce5b13d7f2260134bcd79b3829c9ead536b8e60a265bbb91afc603e062db43a3359894f23b00ssdeep: 24576:/TfEsP85DgJrivY05+QaJRCS2gtE7CvL7xlYnNdTkew8/mx:LcsQ6QL5gtZT7w8ew8/mxtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright:                                                                                                     FileVersion:                     CompanyName: MS Sistemas                                                 Comments: This installation was built with Inno Setup.ProductName: MS Protect                                                  ProductVersion: 1.9                                               FileDescription: MS Protect Setup                                            OriginalFileName:                                                   Translation: 0x0000 0x04b0

Generic.Ransom.Hiddentear.A.FD1D642F (B) also known as:

Cynet	Malicious (score: 99)
ALYac	Generic.Ransom.DMALock.FD1D642F
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.9eeeba
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Generic.Ransom.Hiddentear.A.FD1D642F
MicroWorld-eScan	Generic.Ransom.Hiddentear.A.FD1D642F
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Ransom.Agent.eaiaj
BitDefenderTheta	Gen:NN.ZemsilCO.34058.hm0@a85xHtb
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
FireEye	Generic.Ransom.Hiddentear.A.FD1D642F
Emsisoft	Generic.Ransom.Hiddentear.A.FD1D642F (B)
Avira	TR/Ransom.Agent.eaiaj
Microsoft	Program:Win32/Wacapew.C!ml
Arcabit	Generic.Ransom.DMALock.FD1D642F
GData	Generic.Ransom.DMALock.FD1D642F
MAX	malware (ai score=87)
Ikarus	Trojan-Ransom.Agent
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Malware-gen