What is “Heur.MSIL.Inject.16”?

The Heur.MSIL.Inject.16 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Heur.MSIL.Inject.16 virus can do?

Dynamic (imported) function loading detected
.NET file is packed/obfuscated with Confuser
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Heur.MSIL.Inject.16?


File Info:
name: 0B2E30F2916960841D79.mlw
path: /opt/CAPEv2/storage/binaries/4f0afb38551f4b62d34c2cb178420301d6621cfd499095b6cc31cf96527bf15e
crc32: 2FF729D9
md5: 0b2e30f2916960841d790dcc60705edd
sha1: 1698c5c7e387c0bb4860d392b541350a053a77ab
sha256: 4f0afb38551f4b62d34c2cb178420301d6621cfd499095b6cc31cf96527bf15e
sha512: 58b4b1bf1a2bd64420c2ed6d7745dfc37350f5b5302ec36b7271bea57e0da8740fd1c1d8a88bab1db7883fb11f0d05782332ed771dba2f8b80d4b48ca8ef2239
ssdeep: 98304:vSzTdx9iLlspZF+Khw7RikmLp65vwRlZ+t:aXdx8OpZF+sw1KL4wRH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18AE533D8F35076EEC95FC171EDEC6C50EA25B021070B922785832B99EE5D98BCF091B2
sha3_384: 14aa0bcc574147b32d72e2923b84a86d827fe9e1ea45eaf5fe68daac372c2f87248a3cc7896fb9c5ede6bd17329a81e4
ep_bytes: ff250020400000000000000000000000
timestamp: 2069-03-07 07:56:04

Version Info:
Translation: 0x0000 0x04b0
Comments: Injector for CHeat blocada
CompanyName: OwO
FileDescription: Injector for your game blocada
FileVersion: 3.5.6.0
InternalName: Blocada InjectorCheat.exe
LegalCopyright: NS ©  2021
LegalTrademarks: OwO
OriginalFilename: Blocada InjectorCheat.exe
ProductName: NS Injector OwO
ProductVersion: 3.5.6.0
Assembly Version: 2.0.5.0

Heur.MSIL.Inject.16 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Heur.MSIL.Inject.16
Cybereason	malicious.291696
APEX	Malicious
MicroWorld-eScan	Gen:Heur.MSIL.Inject.16
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:1vTfjsezuF0L82JvV+ggtA)
Emsisoft	Gen:Heur.MSIL.Inject.16 (B)
FireEye	Generic.mg.0b2e30f291696084
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Heur.MSIL.Inject.16
ALYac	Gen:Heur.MSIL.Inject.16
Malwarebytes	Malware.AI.1624651473
eGambit	Unsafe.AI_Score_100%
BitDefenderTheta	Gen:NN.ZemsilF.34182.fp0@a0rkrb
AVG	Win32:TrojanX-gen [Trj]
Avast	Win32:TrojanX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

How to remove Heur.MSIL.Inject.16?

Heur.MSIL.Inject.16 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X