How to remove “Mal/Generic-R + Mal/EncPk-NST”?

The Mal/Generic-R + Mal/EncPk-NST is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Mal/Generic-R + Mal/EncPk-NST virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Crashed cuckoomon during analysis. Report this error to the Github repo.
Network activity detected but not expressed in API logs

How to determine Mal/Generic-R + Mal/EncPk-NST?


File Info:
crc32: 81EE16C1
md5: 7ac13fed91aaba4c0ff40d75d3047929
name: 7AC13FED91AABA4C0FF40D75D3047929.mlw
sha1: 3384da96ea764ff28dab8d494afb76f43ca1dc7c
sha256: 31ab6b9059ece3b31259ea7f08dd1aab1e64657b68e922a768b1e05d277475d2
sha512: e6cbae848e0aaabbe7ecf30f5fe043ca79490ccb96c2b97b3f382315d12e799033dfb2d98d270a689df4c2f4b235d3eb649f62cf3f4b7e010d7f10bf98e29991
ssdeep: 49152:/GAUhnYnuG1Hqsv/QXtgKC2CfW2azXTEblCFhUlYMy2ynD/GmSbhSkY42JT:ZUhBG1L49gKC2Cu2aUYFWl5ylD/YddQT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Somucugico                                                                                          
FileVersion:                     
CompanyName: Ceforaf                                                     
Comments: This installation was built with Inno Setup.
ProductName: Medamed                                                     
ProductVersion: 4.3.7                                             
FileDescription: Medamed Setup                                               
Translation: 0x0000 0x04b0

Mal/Generic-R + Mal/EncPk-NST also known as:

Bkav	W32.AIDetect.malware2
Lionic	Riskware.Win32.Generic.1!c
Elastic	malicious (high confidence)
ALYac	Application.Cerdossa.Gen.1
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Application.Cerdossa.Gen.1
Cybereason	malicious.d91aab
Cyren	W32/Kryptik.BGE.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/InstallCore.Gen.F potentially unwanted
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:AdWare.Win32.DealPly.heur
Alibaba	AdWare:Win32/InstallCore.27104f42
MicroWorld-eScan	Application.Cerdossa.Gen.1
Sophos	Mal/Generic-R + Mal/EncPk-NST
McAfee-GW-Edition	BehavesLike.Win32.Offerbox.wc
FireEye	Generic.mg.7ac13fed91aaba4c
Emsisoft	Application.Cerdossa.Gen.1 (B)
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1134883
Antiy-AVL	Trojan/Generic.ASMalwS.30CB339
Microsoft	Trojan:Win32/Azorult!ml
Arcabit	Application.Cerdossa.Gen.1
GData	Script.Application.InstallCore.MG
MAX	malware (ai score=72)
MaxSecure	Trojan.Malware.74548075.susgen
Fortinet	W32/InstallCore.AZE!tr

How to remove Mal/Generic-R + Mal/EncPk-NST?

Mal/Generic-R + Mal/EncPk-NST removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X