Generik.CWFTKDE (file analysis)

The Generik.CWFTKDE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generik.CWFTKDE virus can do?

• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Deletes executed files from disk
• Harvests cookies for information gathering
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Generik.CWFTKDE?

File Info:
name: 051D4E6017AAE8B5C5E2.mlw
path: /opt/CAPEv2/storage/binaries/e831236aee66871796712c85d0948b475c2220d9ebe3307e33f24411a620aa75
crc32: 631FA177
md5: 051d4e6017aae8b5c5e2da4060403d97
sha1: 69e624fcb2b25fc4f72975a4fd8c59a1333e6f9c
sha256: e831236aee66871796712c85d0948b475c2220d9ebe3307e33f24411a620aa75
sha512: 23c17f451433fa4d323fc1808b1555cbaa98644ca4413e7091085dca474657c01784de6df783fec1ff8fcde7537412cd3f115a8bbc0c4c3be1d57d9e85f8ffc4
ssdeep: 196608:6zLenwA49jD8oeh7ZolvoZnEh9tzq0P/dK9gZm:Eay1D8oeoAZm9NvQ+Zm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T179663333575431C9E0F1C97A9A37FED4B0F6125E4F84E0B4A99EAAC316225E2D703987
sha3_384: 7f771b19b0533819deb7f0a3aa1f462a0fdc3635a8a35750a12eda870e660a57bb9c511b9255fe8c36af06dc5cb13ca4
ep_bytes: 6862b8b9b7e83de40100e954c8ffffd1
timestamp: 2019-08-25 13:02:36

Version Info:
Comments: yuuxia@gmail.com
CompanyName: 1234rxjh.COM
FileDescription: 热血江湖
FileVersion: 2, 1, 7, 0
InternalName: 热血江湖
LegalCopyright: Copy Right (C) RXJH2 2008-2020
LegalTrademarks: 热血江湖
OriginalFilename: 热血江湖.EXE
PrivateBuild: yuuxia@gmail.com
ProductName: 热血江湖
ProductVersion: 2, 1, 7, 0
SpecialBuild: yuuxia@gmail.com
Translation: 0x0804 0x04b0

Generik.CWFTKDE also known as:

How to remove Generik.CWFTKDE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.