Categories: Malware

Generik.ENBPXWQ (file analysis)

The Generik.ENBPXWQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generik.ENBPXWQ virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Enumerates running processes
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Looks up the external IP address
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Uses suspicious command line tools or Windows utilities

Related domains:

crl.verisign.com

aliyuns1.oss-cn-shenzhen.aliyuncs.com

www.baidu.com

www.ip.cn

How to determine Generik.ENBPXWQ?


File Info:
name: C1AAC3AE0E03D060AFF1.mlwpath: /opt/CAPEv2/storage/binaries/01b562371114f260a87dd0e29c00746a1237a3c320fd229dc2feec79e0c4e92bcrc32: 0EB7C0A7md5: c1aac3ae0e03d060aff1821e354d6757sha1: 5802559faad1b6bb9f5859d2d3eeabfc882d30dfsha256: 01b562371114f260a87dd0e29c00746a1237a3c320fd229dc2feec79e0c4e92bsha512: acb4c0be65785e5cbbcea9163c56e3f5608a57d8648a1bc77f1b6a45705195712b9777840e46e379af7310527a38521652d0a2083e18a8cda8579d92401bd0b7ssdeep: 3072:JTGypOb0kC8gtWxexNl+YW9WHHhH2mHoZnNNCOLQrkPXBFv7uOZrWCnJug:JTGypC2fHhHPIsOL1XtSetype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B605E8927EA800E4C11EC53061DAF636EEE154CA15134E63E79DE3941CDA7C31AEEE2Dsha3_384: 137ac95a157325681e0ca2550d0e912ed4091b79621312b17a97060049b721b7911bcef4677c9a46df8136be78b2dbffep_bytes: 558bec6aff6800c240006810a2400064timestamp: 2021-11-03 07:17:32
Version Info:
Comments: 趣日历CompanyName: FileDescription: 趣日历FileVersion: 1, 0, 0, 1InternalName: QDateLegalCopyright: 版权所有 (C) 2021LegalTrademarks: OriginalFilename: QDate.EXEPrivateBuild: ProductName: 趣日历ProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0804 0x04b0

Generik.ENBPXWQ also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Taskun.4!c
MicroWorld-eScan	Trojan.GenericKD.47430161
FireEye	Generic.mg.c1aac3ae0e03d060
CAT-QuickHeal	Trojan.Taskun
McAfee	RDN/Generic.dx
Cylance	Unsafe
K7AntiVirus	Riskware ( 00584baa1 )
Alibaba	Trojan:Win32/Taskun.8c3b2aea
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.faad1b
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.ENBPXWQ
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Taskun.gen
BitDefender	Trojan.GenericKD.47430161
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKD.47430161
Sophos	Compromised Nanjing Zhixiao CodeSigningCert (PUA)
Comodo	TrojWare.Win32.Spy.Agent.04@1wm98v
DrWeb	Trojan.DownLoader44.1581
TrendMicro	TROJ_GEN.R002C0WKK21
McAfee-GW-Edition	RDN/Generic.dx
Emsisoft	Trojan.GenericKD.47430161 (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.47430161
Jiangmin	Trojan.Taskun.e
Avira	HEUR/AGEN.1145546
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Wacatac.sa
Arcabit	Trojan.Generic.D2D3BA11
Microsoft	PWS:Win32/Zbot!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R446022
ALYac	Trojan.GenericKD.47430161
MAX	malware (ai score=83)
VBA32	BScope.Trojan.Taskun
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_GEN.R002C0WKK21
Rising	Trojan.MalCert!1.DA97 (CLASSIC)
Ikarus	Trojan.SuspectCRC
Fortinet	W32/PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/CI.A