Categories: Malware

What is “Graftor.71689”?

The Graftor.71689 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.71689 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity detected but not expressed in API logs

How to determine Graftor.71689?


File Info:
crc32: B35B11E9md5: e9680e28f7ecae3988758a2a1a2185f5name: zhandi.exesha1: ced0f0fe45c991da3b24167330d85fe1ea2fcbc2sha256: 827a68a523be1282ab7de25f659821419f810b0a9780ad0dae932ab53738b729sha512: a9c8beee3cc6d0b6b99b2b05188ffa52c55222c07045e130d6eac93409fbf175831dea31a0820c4403b77081402baececdc68508d7c6a0f27812e382f4adbdf5ssdeep: 49152:wkUeO2Owf+luj6pUmJhM0vkpvb8zvapjOo6qXeUEvhSGQXmzzT:wkUeO2Tf+dDE0viv4zvUjOoJO3vhSpmtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: @x4feex6539x5668FileVersion: 1.0.0.0CompanyName: x571fx8c46Comments: x672cx7a0bx5e8fx4f7fx7528x6613x8bedx8a00x7f16x5199(http://www.eyuyan.com)ProductName: 4399x6218x5730x8054x76dfx4feex6539x5668ProductVersion: 1.0.0.0FileDescription: 4399x4feex6539x5668Translation: 0x0804 0x04b0

Graftor.71689 also known as:

TotalDefense	Win32/PackedBaidu
MicroWorld-eScan	Gen:Variant.Graftor.71689
FireEye	Generic.mg.e9680e28f7ecae39
CAT-QuickHeal	Trojan.IGENERIC
McAfee	Artemis!E9680E28F7EC
AegisLab	Trojan.Win32.Banload.4!c
BitDefender	Gen:Variant.Graftor.71689
K7GW	Adware ( 0050718d1 )
K7AntiVirus	Adware ( 0050718d1 )
NANO-Antivirus	Trojan.Win32.Banload.fhtckd
Cyren	W32/Agent.EW.gen!Eldorado
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R007C0WJH18
Paloalto	generic.ml
ClamAV	Win.Trojan.Kuping-6633833-0
Kaspersky	Trojan-Downloader.Win32.Banload.abfvt
Alibaba	TrojanDownloader:Win32/Banload.97e28269
ViRobot	Trojan.Win32.Z.Graftor.2129408
Tencent	Win32.Trojan-downloader.Banload.Akyq
Ad-Aware	Gen:Variant.Graftor.71689
Sophos	Generic PUA MO (PUA)
Comodo	TrojWare.Win32.Agent.OSCF@5rs7jr
DrWeb	Trojan.Siggen8.21930
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Emsisoft	Gen:Variant.Graftor.71689 (B)
GData	Win32.Application.PUPStudio.A
MAX	malware (ai score=99)
Antiy-AVL	Trojan[Packed]/Win32.FlyStudio
Microsoft	Program:Win32/Uwamson.A!ml
Endgame	malicious (moderate confidence)
Arcabit	Trojan.Graftor.D11809
SUPERAntiSpyware	Trojan.Agent/Gen-OnlineGames
ZoneAlarm	Trojan-Downloader.Win32.Banload.abfvt
Acronis	suspicious
VBA32	BScope.Trojan.Fuerboos
ALYac	Gen:Variant.Graftor.71689
Panda	Trj/GdSda.A
Rising	Malware.Undefined!8.C/N3#90% (RDM+:cmRtazpIg9/YlmQ88g1DMFdsWooK)
Yandex	Trojan.Pasta.Gen.1
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	Riskware/Application
AVG	FileRepMalware
Cybereason	malicious.8f7eca
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.Downloader.ff0