Should I remove “Malware.AI.1473563480”?

The Malware.AI.1473563480 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.1473563480 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Checks adapter addresses which can be used to detect virtual network interfaces
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Network anomalies occured during the analysis.
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities

How to determine Malware.AI.1473563480?

File Info:
name: 2FAFB2A5419BF69475E1.mlw
path: /opt/CAPEv2/storage/binaries/ff0df254123123e3e303fc9b00952c2a0ad2417b42a1958d84bbdf6f2d6fb610
crc32: 4096530E
md5: 2fafb2a5419bf69475e1810fdc511c84
sha1: e9d265ff883549a51b8b8308229b204698faea73
sha256: ff0df254123123e3e303fc9b00952c2a0ad2417b42a1958d84bbdf6f2d6fb610
sha512: 2e189d8321612c50b15d9187d0c0fdb939627a78d574fb5e282ed15f36d6d7b41181a7cbf9dba0955e5fe4a0e3ae4c5c9cc0846d8460edb50925f905a4ee8515
ssdeep: 384:uFAhgmZVqbcbw+LXW50wHTXWkTtBBayP5ZBxo0IJjynNwDJBD1:Y2gvcbw0wHTWkTt/HhZBi/ynNw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BC82C0CE9B6D71A6D6925132279591C851584C78F7099F0F4D2A9E0723AAF12FF0E433
sha3_384: 5c91d3a9c5712ce4ea6403de5f9e109232d1dbbf8044863707c3f214a36d60f6270cef2312eba0d61ee8a45b78a71c3e
ep_bytes: 60be00c040008dbe0050ffff57eb0b90
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Malware.AI.1473563480 also known as:

How to remove Malware.AI.1473563480?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.