Jaik.51428 (file analysis)

The Jaik.51428 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Jaik.51428 virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Detects Bochs through the presence of a registry key
• Attempted to write directly to a physical drive
• Deletes executed files from disk
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities
• Suspicious wmic.exe use was detected

How to determine Jaik.51428?

File Info:
name: 6D7AAB459CBC263266ED.mlw
path: /opt/CAPEv2/storage/binaries/d05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518
crc32: C7CAC6C9
md5: 6d7aab459cbc263266ed819470425c3b
sha1: 098b7d7a3b2039d26cbb3e307dde6e373c2cb0f6
sha256: d05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518
sha512: f24aeb4006047ee4b209a386088482186063f2a68ee48fa1485da130f487cdf15a5b66502f3bcddc6ecffc8d76bb65ff7ada7d0c7571cf1622027a485321126f
ssdeep: 12288:1XwOrReFWQFrp65S65VGxoTwEzr9VhURFVBc3nkUD:1XwOrRsPpkzuuTXvhU1ol
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D2A4020177D5C4B4C0A50271B8A9BBB20876FDF44B0549D3AFD47E2B6A706D0A73E29E
sha3_384: a65cadd7f2a3942f3e1f39ac21a97550adbf09d85b4252217ffdc4bffb2aa1f8b3387a1cfe8c4d2398f5b2301b7e5520
ep_bytes: 558bec6aff6870c4410068c095410064
timestamp: 2012-12-31 00:38:51

Version Info:
CompanyName: Adobe Systems, Incorporated
FileDescription: Adobe Photoshop
FileVersion: 7.0
InternalName: Photoshop
LegalCopyright: © 1990-2002 Adobe Systems Inc.
OriginalFilename: Photoshop.exe
ProductName: Adobe Photoshop
ProductVersion: 7.0
Translation: 0x0409 0x04b0

Jaik.51428 also known as:

How to remove Jaik.51428?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.