Categories: Malware

Graftor.720640 (file analysis)

The Graftor.720640 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.720640 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine Graftor.720640?


File Info:
name: 0299416860FF44CC85F5.mlwpath: /opt/CAPEv2/storage/binaries/9e6c8289297825c53af3945ee4548f1a31e31c5a3d943679cb4e641b840c7ae0crc32: 873D9DB2md5: 0299416860ff44cc85f53cc352c30740sha1: 24b0770837449907c2a0e655a59b7b7c8901077dsha256: 9e6c8289297825c53af3945ee4548f1a31e31c5a3d943679cb4e641b840c7ae0sha512: a79957ee113ecf43676934a40adead737d84a66634af6e2a153c7fd5c121dca5a77e14af5306cd7accb59e3d7522df39f145494dd93cda159cebb99cd19013fcssdeep: 49152:oCfbkhThuzlpJOsrhtutDOxoq9degryDlazLi+CxmYlazLi:LDstClpPrLgDOxoJ+yZazLi+CxBazLitype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T182B5D013F655C4F2CB4A153111BB6B3ABA34AE951E30CE83D3A4FDB85E322919E2711Dsha3_384: 68fe7a9f99f33efe19ed24451d7a2e526a512fc95a736da03cf0ad4aff28b311eb96136953eaa6d22e80049c91e1b931ep_bytes: 558bec6aff68980b5e006844ae490064timestamp: 2020-11-05 15:16:28
Version Info:
0: [No Data]

Graftor.720640 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.lwTm
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.720640
FireEye	Generic.mg.0299416860ff44cc
ALYac	Gen:Variant.Graftor.720640
Cylance	Unsafe
K7AntiVirus	Trojan ( 005246d51 )
K7GW	Adware ( 004b87ea1 )
CrowdStrike	win/malicious_confidence_60% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AC potentially unwanted
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Generic-9820446-0
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Gen:Variant.Graftor.720640
Ad-Aware	Gen:Variant.Graftor.720640
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Trojan.XPack.~gen1@1rwlif
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vh
Emsisoft	Gen:Variant.Graftor.720640 (B)
Ikarus	Trojan.Black
GData	Win32.Trojan.PSE.12FI8JT
Jiangmin	Trojan.BitCoinMiner.hi
Antiy-AVL	Trojan/Generic.ASCommon.FA
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!0299416860FF
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Tiggre
Malwarebytes	Trojan.MalPack.FlyStudio
TrendMicro-HouseCall	TROJ_GEN.R002H07IH21
Rising	Malware.Heuristic!ET#99% (RDMK:cmRtazqLVgIvN0EWnJFh04CYfDYE)
Yandex	Trojan.GenAsa!J0ThuLnx7yE
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.ELG!tr.pws
BitDefenderTheta	Gen:NN.ZexaF.34062.msW@a4QCg2hb
Cybereason	malicious.860ff4