Malware

Malware.AI.1165149143 malicious file

Malware Removal

The Malware.AI.1165149143 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1165149143 virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Malware.AI.1165149143?


File Info:

name: C051E7C46D4A81F510A0.mlw
path: /opt/CAPEv2/storage/binaries/78e76fc71dae9dadd8742101929bb927d070a57d59058006fe3dd2c41a654e24
crc32: 4D2194BB
md5: c051e7c46d4a81f510a005da93738dba
sha1: b624b273385bc006b571f0c4819e38b14ac25388
sha256: 78e76fc71dae9dadd8742101929bb927d070a57d59058006fe3dd2c41a654e24
sha512: 8a386e60e362452eadfbd69c5f0dd616f5d983ec6b1f168ec299ec605cf5755ad87e0d51131d23204235f2871b490aa5199c8f4a7fb49f4a1b98c3aaf4ca6fc7
ssdeep: 6144:7pQA8A/V+DA2XN8ujK9nYKj24tPlp+4kTE5xoR5rJmBRNKuO80Hl+OCC9Bt0:76bA8fNJCnYivkTAHBrDwl+OCoBe
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1E2945A74D61438CCD52FDEFB38D8EB8499542E50F2DEA012AFFBD85903A876A4324572
sha3_384: c9ed0ad2fbe83503b9293cac0cc70d5ac72da954d7954989a493b38cf905565f2a5be124b167b3e28154901fcee88863
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2070-05-01 03:18:25

Version Info:

CompanyName: Microsoft Corporation
FileDescription: x86 Performance Counter Host
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: perfhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: perfhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

Malware.AI.1165149143 also known as:

Elasticmalicious (high confidence)
DrWebWin32.Expiro.150
MicroWorld-eScanWin32.Expiro.Gen.6
CylanceUnsafe
CrowdStrikewin/malicious_confidence_80% (D)
VirITWin32.Expiro.CV
CyrenW32/Expiro.AN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.NDG
TrendMicro-HouseCallVirus.Win32.EXPIRO.AD
AvastWin32:Xpirat-C [Inf]
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
SophosML/PE-A + Mal/EncPk-MK
VIPREVirus.Win32.Expiro.dp (v)
TrendMicroVirus.Win32.EXPIRO.AD
EmsisoftWin32.Expiro.Gen.6 (B)
GDataWin32.Expiro.Gen.6
JiangminTrojan.PSW.Stealer.abj
MicrosoftTrojan:Win32/Raccoon.EC!MTB
CynetMalicious (score: 100)
Acronissuspicious
VBA32BScope.Trojan.Wacatac
MAXmalware (ai score=87)
MalwarebytesMalware.AI.1165149143
APEXMalicious
SentinelOneStatic AI – Malicious PE
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
Cybereasonmalicious.46d4a8
PandaTrj/Genetic.gen

How to remove Malware.AI.1165149143?

Malware.AI.1165149143 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment