Generik.JOFWCKR malicious file

The Generik.JOFWCKR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Generik.JOFWCKR virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid
Binary file triggered YARA rule
Anomalous binary characteristics

How to determine Generik.JOFWCKR?


File Info:
name: 5F3DC15D74BF3D442167.mlw
path: /opt/CAPEv2/storage/binaries/6fd619dcc6947a7673d0808f09a93162f702d6c30acb6a14226b44fdfbbf9def
crc32: FA41F75C
md5: 5f3dc15d74bf3d44216784872ae9631e
sha1: 1bec0e6ffc8cb53a9d0a32c45fd42b1de7da99ae
sha256: 6fd619dcc6947a7673d0808f09a93162f702d6c30acb6a14226b44fdfbbf9def
sha512: 59f29fcb5cf0bd3481df12b4b9fcbee1c3ed52a8e7b7298748427fc6581482aeb6e427e2530956c6b3cdb9a9b1683a3079291a11585deb433cb1b8fb11541181
ssdeep: 24576:1lwBTJR4E8OAPjO7KX53RTh0tFda3C/DrNDS5lSH7WUtLpwbtLpw:08OArOO53RTqtiCrrNDS5lSbbtL2tL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F2458C11F7E98172EAA342368DB6A359D576BD610F3086DB22947B2F4E323D09D30727
sha3_384: 30e99c51b92b494f12f7fff307a02c5b66a616919a61f413a37a91cb9b92ccba8a9595146d4cb5d93a60255d3357c98f
ep_bytes: e855030000e96bfdffffccff259cc140
timestamp: 2012-09-24 02:30:08

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: Eula display
FileVersion: 11.0.0.379
InternalName: Eula.exe
LegalCopyright: Copyright 2010-2012 Adobe Systems Incorporated.  All rights reserved.
OriginalFilename: Eula.exe
ProductName: EULA
ProductVersion: 11.0.0.379
Translation: 0x0409 0x04e4

Generik.JOFWCKR also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.AutoRun.o!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.5f3dc15d74bf3d44
Skyhigh	BehavesLike.Win32.Expiro.th
McAfee	Artemis!5F3DC15D74BF
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
Alibaba	Worm:Win32/Pajetbin.6e7f4d48
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Generik.JOFWCKR
APEX	Malicious
TrendMicro-HouseCall	WORM_AUTORUN.BGA
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Malware.Dqan-9933037-0
Kaspersky	Worm.Win32.AutoRun.vx
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
F-Secure	Trojan.TR/Patched.blqzp
DrWeb	Win32.HLLW.Autoruner.547
VIPRE	Trojan.Agent.Xiang.A
TrendMicro	WORM_AUTORUN.BGA
Sophos	Mal/Generic-S
Ikarus	Trojan.Agent
Varist	W32/Pajetbin.G.gen!Eldorado
Avira	TR/Patched.blqzp
Antiy-AVL	Worm/Win32.AutoRun.nar
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Worm.Win32.AutoRun.vx
GData	Win32.Trojan.Agent.AYTAAD
Cynet	Malicious (score: 100)
ALYac	Trojan.Agent.Xiang.A
Google	Detected
VBA32	Worm.AutoRun
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Chgt.AD
Rising	Worm.VB!1.DA41 (CLASSIC)
Yandex	Trojan.GenAsa!g8z8LT30jj4
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/AutoRun.9412!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)
alibabacloud	Trojan:Win/Mikey

How to remove Generik.JOFWCKR?

Generik.JOFWCKR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X