Mal/EncPk-APV malicious file

The Mal/EncPk-APV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/EncPk-APV virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Mimics the system’s user agent string for its own requests
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
A named pipe was used for inter-process communication
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
A system process is generating network traffic likely as a result of process injection
Installs itself for autorun at Windows startup
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.ip-adress.com

How to determine Mal/EncPk-APV?


File Info:
crc32: 68DCDF1B
md5: 94290b8135dacf7908fb2d5eb1683cd1
name: 5555555.png
sha1: 16c86c35937d13a99b1c3edb4e9935771d335621
sha256: 55a1894d8648075f33ab9f4643097c3c1c5107d61beb35a7dc6a229097348c3f
sha512: 43e15fac958d344aafb93cab8965a113fe569d1b0a2b6c1cfc7db9b3f8b33f12cda8c46de041f2c5a5c921fe64ce96c1dd51b7536a0ffb837d5060186cff6c9e
ssdeep: 12288:Qh+ciXIDC9rgopYwTSxz5/yKNg+rC7bOVHaM:h2XopYwTe6Or8bOVHaM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1995-2017
InternalName: gimp-console-2.8
FileVersion: 2.8.20.0
CompanyName: Spencer Kimball, Peter Mattis and the GIMP Development Team
ProductName: GNU Image Manipulation Program
ProductVersion: 2.8.20
FileDescription: GNU Image Manipulation Program
OriginalFilename: gimp-console-2.8.exe
Translation: 0x0409 0x04b0

Mal/EncPk-APV also known as:

Bkav	HW32.Packed.
FireEye	Generic.mg.94290b8135dacf79
McAfee	W32/PinkSbot-GW!94290B8135DA
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.Emotet.AHZ
Cybereason	malicious.5937d1
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34130.IG1@aSYeKCoi
Symantec	ML.Attribute.HighConfidence
GData	Trojan.Emotet.AHZ
Rising	Malware.Heuristic!ET#77% (RDMK:cmRtazoJn7Sbv3eH3MoHhGPOR6OO)
Endgame	malicious (high confidence)
Emsisoft	Trojan.Agent (A)
Trapmine	malicious.high.ml.score
Sophos	Mal/EncPk-APV
APEX	Malicious
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Wacatac.C!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	BScope.TrojanRansom.Shade
Malwarebytes	Trojan.MalPack.SGI
ESET-NOD32	a variant of Win32/GenKryptik.ENDH
SentinelOne	DFI – Malicious PE
eGambit	PE.Heur.InvalidSig
Fortinet	W32/Kryptik.HEKH!tr
Webroot
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM19.1.269C.Malware.Gen

How to remove Mal/EncPk-APV?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Mal/EncPk-APV malicious file