JS/Retefe.P (file analysis)

The JS/Retefe.P is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What JS/Retefe.P virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A scripting utility was executed
• A script process created a new process
• Attempts to execute suspicious powershell command arguments

How to determine JS/Retefe.P?

File Info:
name: 0A4E6F328530EA28AE0A.mlw
path: /opt/CAPEv2/storage/binaries/750ac54eee8d6e6d6103e8e08bf80e6464479ec6544af1fde2b140344824b260
crc32: 8F2C0C8D
md5: 0a4e6f328530ea28ae0aae20a072b182
sha1: 51bd48f30ad996eede1ea1630bfe9f0ef1e61f8b
sha256: 750ac54eee8d6e6d6103e8e08bf80e6464479ec6544af1fde2b140344824b260
sha512: 8666d7c63e83ba2684867bcfe65caf39452ce82653364dfb62bbec24e13a1f9c7d6ad538cdf396ebc85709d0e91364ea0face606a8b78b1265cf7922ef8a8fcd
ssdeep: 6144:RQPStHxkN/86myJ1YpQPBZnzRk5Uo01SSMBso+wrWp3RW2Qdv7vvAD7EJmit:a6xT6NJ10EnFYT01SSMeofrWvW2Qh3AU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D274E01277C180B2D5B25A340EF9A731AA7CBC202F295A4FA7C41B6D5F700D06629FB3
sha3_384: 699eda87a7432caa9b5d89f0a77e33f966f68d1e59b83a7d7a0970c2064cae92f128df1d306e44259ca1e209b3cfa948
ep_bytes: e823050000e98efeffff3b0da8d04200
timestamp: 2017-04-18 14:54:03

Version Info:
0: [No Data]

JS/Retefe.P also known as:

How to remove JS/Retefe.P?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.